Risk
10/15/2013
12:16 PM
50%
50%

Verizon Enhances Cloud-Based Identity Platform

Universal Identity Services 2.0 comes with an updated mobile app, QR code-enabled access, and a simplified end-user interface.

Top 10 Government IT Innovators Of 2013
Top 10 Government IT Innovators Of 2013
(click image for larger view)
Verizon has added new capabilities to its cloud-based identity platform, offering government users a more secure system that goes beyond a username and password.

The platform, Universal Identity Services, combines a person's username and password with a one-time password or biometric scan, such as fingerprint recognition. Authenticated users can get access to online content and corporate resources -- and depending on the level of assurance, electronic medical records -- on computers, smartphones or tablets. Universal Identity Services runs in three secure data centers, and meets standards through the Health Insurance Portability and Accountability Act (HIPAA).

When it comes to government users, the benefits of cloud-based identity and access management are twofold, Tracy Hulver, senior identity strategist of Verizon Enterprise Solutions, said in a phone interview. "First, agencies want to make it easier and less expensive to validate employees and contractors. We can provide that two-factor authentication," said Hulver. "Second, what the government is really wrestling with is how to authenticate citizens. How can the government cut down on the number of credentials that citizens have, while keeping the costs down? The Affordable Care Act (ACA) online portal, for instance, is having problems getting people on and signed up with a username and password."

[ Want more on government security efforts? Read Energy Dept. Invests $30 Million In Utility Security. ]

One solution, Hulver said, is providing citizens with a single identity that they can use government-wide. Last December, Verizon teamed with Criterion Systems to develop a more secure online identity system. The National Institute of Standards and Technology (NIST) awarded $9 million to five pilot programs lead by teams of online-identity and technology providers in support of the National Strategy for Trusted Identities in Cyberspace (NSTIC). Verizon is one of two providers of high-assurance identity credentials on a pilot program.

NSTIC, a public-private initiative launched by the White House in 2011, aims to create cost-effective and easy-to-use "trust elevation," or validation efforts, for online credentials. With trust elevation, individuals would be able to use one set of credentials to access any site, including online banking and medical records. The system would use additional information to electronically validate a user, such as a fingerprint or a mobile phone number.

According to Hulver, Verizon, as a third-party identity provider, can scale to tens of thousands of users for a considerably smaller price point. The new features included in Verizon's Universal Identity Services are appealing to federal agencies looking for added security, he said. One such feature is Quick Response (QR) code-enabled access. Users can access a website using a unique QR code generated on a login screen, or scan a QR code as second-factor authentication on a smartphone.

The enhanced Universal Identity Services platform also includes an updated mobile app for the iOS, Android, Windows, and Blackberry operating systems; legally binding digital signature capabilities required for electronic prescriptions, online tax filing and license renewals; and a simplified end-user interface that provides administrators with an enhanced dashboard and operations reporting.

In addition to the new capabilities, Verizon has expanded the platform -- which was previously only offered in the U.S. -- to Europe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2001-1594
Published: 2015-08-04
GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, an...

CVE-2002-2445
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) "service." for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdwon user, which has unspecified impact and attack vectors.

CVE-2002-2446
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors.

CVE-2003-1603
Published: 2015-08-04
GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2) "2" for the LOCAL user of the FTP server for the Codonics printer, which has unspecified impact and attack vectors.

CVE-2004-2777
Published: 2015-08-04
GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002...

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!