Risk
4/14/2011
05:36 PM
Connect Directly
RSS
E-Mail
50%
50%

White House To Release Final Trusted Identity Plan

The public-private effort to strengthen online identity management and authentication will face challenges when it comes to execution, privacy, and security.

Obama's Tech Tools
(click image for larger view)
Slideshow: Obama's Tech Tools
The White House Friday will release the final version of a national identity and authentication strategy aimed at standardizing and strengthening identity management and authentication procedures for online transactions.

The plan is the result of more than a year of effort and collaboration between the White House, industry, government agencies, and privacy advocates.

But the private sector is taking a wait-and-see approach before ruling on whether the plan will resolve a long-time problem of the multiple identities and passwords people use when making online transactions, and the threats to privacy and security they pose.

The Obama administration's National Strategy for Trusted Identities in Cyberspace (NSTIC) "addresses one of the thorniest issues facing those who want to engage in significant or sensitive online transactions: the lack of standard, interoperable, and trusted systems for proving online identity," Thomas Smedinghoff, a partner in the Privacy and Data Security practice at Wildman Harrold Allen & Dixon LLP in Chicago, said in an email. Smedinghoff has reviewed and commented on drafts of NSTIC.

U.S. Commerce Secretary Gary Locke, Chair of the National Economic Council Gene Sperling and White House Cybersecurity Coordinator Howard A. Schmidt are expected to release the plan, which has been in draft release since last June, at an event at the U.S. Chamber of Commerceon Friday.

Among other things, it will recommend changes to privacy laws, possible revisions to the liability of online identity providers, and the creation of new government offices to play a leadership role in digital identity and authentication issues.

The strategy also will design and implement what it's calling an "Identity Ecosystem," which will include comprehensive identification and authentication standards and improved definition of the rights and responsibilities of various constituencies involved in online transactions including identity providers and citizens.

The ecosystem also would create an environment in which both public and private service providers can offer people secure online credentials that can work across a range of websites.

The proposal has one security provider concerned that, if not carefully monitored or regulated, the ecosystem could "turn into a free-for-all Identity marketplace."

Identity Finder, which provides security for data used in identify theft, said if not managed properly, the ecosystem could create risks such as the opportunity for "hyper-identity theft" through the creation of powerful identity credentials; a false sense of control, privacy, and security among users; and new markets in which to commoditize human identity, according to a statement.

Others in the private sector expressed concern that the plan, while a fine idea, may not achieve its goals unless the federal government takes the swift action it's promising to enact the plan.

"Like all strategies, it will only be as good as its execution," said Mike Osburn, principal at Booz Allen Hamilton, a top federal contractor who has worked closely with the government on the plan.

He said in an email that while the industry as a whole is behind NSTIC, "The litmus test will be whether it really begins to accept private credentials as a means to offer a more secure, more convenient experience for consumers."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.