NASA tests smart card tech

While national attention is focused on NASA's efforts to improve interplanetary exploration, the space agency is working to improve its identity management on Earth.

NASA officials will test the One NASA access card during a May field trial at the Marshall Space Flight Center in Huntsville, Ala. Agency employees and contractors will use the card to access space center facilities and computer information systems.

After the initial trial session, NASA will expand the field test to include approximately 2,000 employees. The agency has larger future goals in mind for the access card if the field test meets expectations.

"If the field trials are successful, and we receive the approval of the Office of Management and Budget, we plan to deploy more than 100,000 smart cards before the end of [fiscal] '05," said David Saleeba, NASA's assistant administrator for security management and safeguards.

Maximus Inc. of Reston, Va., was awarded a $93 million task order Jan. 8 by the General Services Administration to assist NASA in developing the smart cards. NASA is the first customer for GSA's Smart Access Common ID contract, managed by the Federal Technology Service.

The One NASA card is designed so that cardholders swipe or insert it into a smart card reader to access the facility or computer systems.

Smart cards will greatly improve identity assurance, said John Piasecky, NASA director of security management. "The One NASA smart card was developed in an effort to deter counterfeiting," he said.

Along with a photo to identify each cardholder, NASA will enhance access control and computer security by requiring users to enter a personal identification number after inserting the card into a computer's card reader.

In addition to ensuring proper access privileges, Piasecky also said that the cards will be color-coded for specific employees. Different colors will be issued for federal employees, contractors and civil servants, which will provide the advantage of visual identification of individuals from different fields.

With the pilot, NASA becomes the latest federal agency to explore the usefulness of smart cards. The Defense Department has been the largest user of identity management cards, with plans to complete its rollout of 4.5 million Common Access Cards by March.

DOD officials are also preparing for a pilot program of the Defense Cross-

Credentialing Identity System, which is similar to the One NASA concept.

Both programs are designed to allow identity authentication across multiple agencies and vendors. The DCIS card will contain a fingerprint element, but NASA's card will not use biometrics.

NASA is taking the right approach by including the contractors on the One NASA rollout, said Michael Mestrovich, president and CEO of Unlimited New Dimensions LLC and a consultant on DOD's pilot program.

"One of the issues that we're working with the DOD on is the interoperability between government and industry partners, and I would think that with the amount of outsourcing that NASA does, interoperability would be an important issue," he said.

Mestrovich feels that access cards are necessary for identity management, which must be rolled out in phases.

"Identity management is an enterprise-level solution," he said. "From there, privileged management becomes a decentralized model, but you've got to start at the enterprise level."