Risk
10/15/2013
12:16 PM
50%
50%

Verizon Enhances Cloud-Based Identity Platform

Universal Identity Services 2.0 comes with an updated mobile app, QR code-enabled access, and a simplified end-user interface.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Verizon has added new capabilities to its cloud-based identity platform, offering government users a more secure system that goes beyond a username and password.

The platform, Universal Identity Services, combines a person's username and password with a one-time password or biometric scan, such as fingerprint recognition. Authenticated users can get access to online content and corporate resources -- and depending on the level of assurance, electronic medical records -- on computers, smartphones or tablets. Universal Identity Services runs in three secure data centers, and meets standards through the Health Insurance Portability and Accountability Act (HIPAA).

When it comes to government users, the benefits of cloud-based identity and access management are twofold, Tracy Hulver, senior identity strategist of Verizon Enterprise Solutions, said in a phone interview. "First, agencies want to make it easier and less expensive to validate employees and contractors. We can provide that two-factor authentication," said Hulver. "Second, what the government is really wrestling with is how to authenticate citizens. How can the government cut down on the number of credentials that citizens have, while keeping the costs down? The Affordable Care Act (ACA) online portal, for instance, is having problems getting people on and signed up with a username and password."

[ Want more on government security efforts? Read Energy Dept. Invests $30 Million In Utility Security. ]

One solution, Hulver said, is providing citizens with a single identity that they can use government-wide. Last December, Verizon teamed with Criterion Systems to develop a more secure online identity system. The National Institute of Standards and Technology (NIST) awarded $9 million to five pilot programs lead by teams of online-identity and technology providers in support of the National Strategy for Trusted Identities in Cyberspace (NSTIC). Verizon is one of two providers of high-assurance identity credentials on a pilot program.

NSTIC, a public-private initiative launched by the White House in 2011, aims to create cost-effective and easy-to-use "trust elevation," or validation efforts, for online credentials. With trust elevation, individuals would be able to use one set of credentials to access any site, including online banking and medical records. The system would use additional information to electronically validate a user, such as a fingerprint or a mobile phone number.

According to Hulver, Verizon, as a third-party identity provider, can scale to tens of thousands of users for a considerably smaller price point. The new features included in Verizon's Universal Identity Services are appealing to federal agencies looking for added security, he said. One such feature is Quick Response (QR) code-enabled access. Users can access a website using a unique QR code generated on a login screen, or scan a QR code as second-factor authentication on a smartphone.

The enhanced Universal Identity Services platform also includes an updated mobile app for the iOS, Android, Windows, and Blackberry operating systems; legally binding digital signature capabilities required for electronic prescriptions, online tax filing and license renewals; and a simplified end-user interface that provides administrators with an enhanced dashboard and operations reporting.

In addition to the new capabilities, Verizon has expanded the platform -- which was previously only offered in the U.S. -- to Europe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?