Creating technologies that authenticate users with a high degree of confidence has always been a challenge, not only because of the typical complexity of the systems, but also because of the amount of confidence that must be placed within the end-user to appropriately secure his or her own user authentication information, most commonly the user ID and password.
Over the past several years the U.S. Government Accountability Office (GAO) has identified the historically poor authentication and access control practices as barriers for successful information sharing between not only government entities, but also with the private sector.
Over the past few years there have been various laws and executive orders specifying the actions necessary to improve information sharing for government agencies, most particularly since September 11, 2001. For example, Homeland Security Presidential Directive 12 (HSPD-12) of 2004 required a common identification standard using two-factor authentication for federal employees and contractors for gaining physical access to controlled facilities, as well as logical access to controlled information systems. Two-factor authentication definitely addresses security risks, but the implementation of such systems needs to be done with careful planning.
I just posted a new paper, “Addressing Government Agency Access and Authentication Challenges,” to my site. Within it I discuss the challenges U.S. government agencies face in meeting authentication and access controls requirements.
Check it out and let me know what you think!
Tags: access controls, authentication, awareness and training, government, HSPD-12, Information Security, IT compliance, policies and procedures, privacy