Risk
10/15/2013
12:16 PM
Connect Directly
RSS
E-Mail
50%
50%

Verizon Enhances Cloud-Based Identity Platform

Universal Identity Services 2.0 comes with an updated mobile app, QR code-enabled access, and a simplified end-user interface.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Verizon has added new capabilities to its cloud-based identity platform, offering government users a more secure system that goes beyond a username and password.

The platform, Universal Identity Services, combines a person's username and password with a one-time password or biometric scan, such as fingerprint recognition. Authenticated users can get access to online content and corporate resources -- and depending on the level of assurance, electronic medical records -- on computers, smartphones or tablets. Universal Identity Services runs in three secure data centers, and meets standards through the Health Insurance Portability and Accountability Act (HIPAA).

When it comes to government users, the benefits of cloud-based identity and access management are twofold, Tracy Hulver, senior identity strategist of Verizon Enterprise Solutions, said in a phone interview. "First, agencies want to make it easier and less expensive to validate employees and contractors. We can provide that two-factor authentication," said Hulver. "Second, what the government is really wrestling with is how to authenticate citizens. How can the government cut down on the number of credentials that citizens have, while keeping the costs down? The Affordable Care Act (ACA) online portal, for instance, is having problems getting people on and signed up with a username and password."

[ Want more on government security efforts? Read Energy Dept. Invests $30 Million In Utility Security. ]

One solution, Hulver said, is providing citizens with a single identity that they can use government-wide. Last December, Verizon teamed with Criterion Systems to develop a more secure online identity system. The National Institute of Standards and Technology (NIST) awarded $9 million to five pilot programs lead by teams of online-identity and technology providers in support of the National Strategy for Trusted Identities in Cyberspace (NSTIC). Verizon is one of two providers of high-assurance identity credentials on a pilot program.

NSTIC, a public-private initiative launched by the White House in 2011, aims to create cost-effective and easy-to-use "trust elevation," or validation efforts, for online credentials. With trust elevation, individuals would be able to use one set of credentials to access any site, including online banking and medical records. The system would use additional information to electronically validate a user, such as a fingerprint or a mobile phone number.

According to Hulver, Verizon, as a third-party identity provider, can scale to tens of thousands of users for a considerably smaller price point. The new features included in Verizon's Universal Identity Services are appealing to federal agencies looking for added security, he said. One such feature is Quick Response (QR) code-enabled access. Users can access a website using a unique QR code generated on a login screen, or scan a QR code as second-factor authentication on a smartphone.

The enhanced Universal Identity Services platform also includes an updated mobile app for the iOS, Android, Windows, and Blackberry operating systems; legally binding digital signature capabilities required for electronic prescriptions, online tax filing and license renewals; and a simplified end-user interface that provides administrators with an enhanced dashboard and operations reporting.

In addition to the new capabilities, Verizon has expanded the platform -- which was previously only offered in the U.S. -- to Europe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4973
Published: 2014-09-23
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.

CVE-2014-5392
Published: 2014-09-23
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

CVE-2014-6646
Published: 2014-09-23
The bellyhoodcom (aka com.tapatalk.bellyhoodcom) application 3.4.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6647
Published: 2014-09-23
The ElForro.com (aka com.tapatalk.elforrocom) application 2.4.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6648
Published: 2014-09-23
The iPhone4.TW (aka com.tapatalk.iPhone4TWforums) application 3.3.20 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio