5 reasons federal agencies are so challenged by identity and access management

Today, about 64 percent of U.S. federal government IT leaders view identity management solutions as critical to addressing the increased cybersecurity threats to agencies, according to a recent survey. As identity and access management becomes increasingly important to protect against outsider cyber threats and ensure that the right users have access to the right information, it is clear that effective IAM faces several challenges.

While the problems surrounding IAM are not specific to the public sector, they have a critical impact on government. Proper IAM is necessary for federal employees to access pertinent data, systems, and facilities and ensure that agencies are not compromised by external actors. As traditional identifiers like Social Security numbers become outdated and easily compromised, personal, business and federal data becomes increasingly at risk. Here's a look at some of the specific IAM challenges in the federal sector:

1. Prevalence of and easy access to personal data

Many personal profiles on social media leave little hidden; email addresses, phone numbers, and date of birth are accessible with the click of a button. The same can be said for previously secured forms of ID, such as Social Security numbers and date of birth, which are sometimes sent carelessly via email. Personal data can be easily compromised by hackers and used to gain access to confidential systems. Cybercriminals not only steal this kind of information but also set up businesses on the black market where personal information is offered for sale, for as little as a dollar per SSN.

2. Volume of applications and resources that require users to remember a username and password -- which leads to using the same password

Due to the prevalence of outside threats, passwords have become essential to holding and managing any account online. Organizations, companies and the federal government all continue to rely on online accounts to complete critical functions like human resources, finance, and contract management. This puts individuals in the position of creating numerous passwords. According to a 2017 study by Digital Guardian, 70 percent of respondents reported having more than 10 password-protected online accounts, resulting in password overload. Users often tire of remembering various passwords for different accounts and instead choose the same password for multiple accounts; if one account is compromised, others can be easily compromised as well.

3. Multi-factor authentication -- often effective, but not user friendly

This creative form of identity proofing can be effective, but it is far from user friendly and is often viewed by users as unnecessarily time consuming. For federal employees or contractors who require access to multiple networks and systems, they are often required to carry a separate access card or RSA token, which can be burdensome and difficult to manage -- to the point that some users opt to aim a webcam at all of their RSA tokens. Multi-factor authentication is also not foolproof, as it can still be compromised by sophisticated efforts from hackers. And multifactor authentication is often used by high-value applications, making them a target for hackers who are well aware of the potential benefits to be reaped.

4. Challenges introduced via cloud

The use of cloud applications has grown substantially by organizations and the federal section alike, as employees streamline their work, and organizations can improve efficiency and reduce costs. Workforces can now be spread all over the world due to the interconnectivity enabled by cloud technology and programming; however, this makes it increasingly difficult to maintain security, and when several different cloud systems are used, it becomes challenging to determine whether the correct people have access to information. This can leave valuable, classified information up for grabs and companies unprotected from hacks. Additionally, inadequate security by a vendor or third-party network can put data at risk.

5. Common lack of a centralized, authoritative IAM repository

Every enterprise needs visibility into all aspects of IAM, yet many lack a centralized database for effective management and security of user identities and data infrastructures. Conversely, any centralized IAM database containing data secrets (e.g. confidential customer contact database, private keys, passwords, etc.) is an extremely high-value target for attackers. So it's critical that as part of standing up a centralized repository, management analyze risks to calculate the potential impact of centralizing critical data so appropriate countermeasures can be implemented. A security system that ensures automated activity monitoring and audit reporting needs could close the loop on potential security issues. An enterprise-wide centralized database security system is part of defense in-depth security system, using inherently protective, detective and corrective controls.

What's the solution?

In our increasingly sophisticated digital world; AI technologies such as machine learning, natural language processing, big data and analytics, data mining, automation and the internet of things are delivering significant results. It is critical that the right people have access to the right information, and good IAM means seamlessly controlling access and rights for every user on the network regardless of time, space, or place.

While many organizations may have IAM best practices in place, those practices and procedures are only effective if they are adhered to across the organization. Unchecked or mismanaged exceptions and exemptions to IAM policies and rules are most commonly the reasons for compromised data. While multi-factor authentication will eventually become ubiquitous in federal and commercial organizations alike, those who implement the requirements will constantly have to balance between security compliance and operational flexibility.

What we can hope is that as technologies such as token-based biometric access, blockchain, tokenization, and automation through real-time alerts and notifications will continue to evolve and take root, federal agencies will leverage new capabilities to more effectively balance the challenge of security and convenience. On the one hand, users are demanding more control of their identities -- and as a decentralized digital ledger, blockchain can grant that control by requiring minimal information for every transaction that requires authorization. On the other hand, a biometric-based solution such as DHS's Homeland Advanced Recognition Technology (HART), centralizes a wealth of sensitive data, but also makes it a significant target for malicious actors. Biometric info might be more difficult to use if stolen, it's still plausible, and a biometric solution also calls into question the constitutionality of such a capability with respect to privacy.

While there's plenty of new tech evolving that can help with IAM, it's important not to just leverage the benefits of those advances, but also keep up with best practices and employ some of the less expensive, yet often effective best practices. Automation, for example, can be used to de-provision user accounts across all enterprise applications when a user departs the organization. An effective IAM solution requires balance -- making the process and procedures manageable for those responsible, and making it reliable, secure and easy for the end users.

There have been many attempts in recent years to develop a truly secure IAM solution, both in terms of technical solutions as well as policies and regulation -- from European Union's General Data Protection Regulation to the NIST Special Publications 800 series. While there have been rapid advances in technology, some of those same breakthroughs are the reason that IAM solutions have failed in the past and must continue to evolve. Federal agencies need to incorporate IAM into their overall modernization roadmap -- ensuring that today's secure solution is still secure tomorrow. With additional advances, such as quantum computing, within reach, it's critical that agencies start planning for those advances and adjusting their IAM strategy now.