When I consider the technologies deployed to support the warfighter, a few mantras come to mind.<\/p>\n\n\n\n
The first is \u201ccrawl, walk, run.\u201d Technologies can only be fielded after ample testing, which slows the recognized advantages of a specific technology but reduces mission risk and potentially protects lives.<\/p>\n\n\n\n
The second is \u201cmove at the speed of mission,\u201d which translates to \u201cyou have to move faster to field supporting technologies because the mission can\u2019t wait.\u201d<\/p>\n\n\n\n
These two ideas are important, yet contradictory. Fielding innovative technologies has always been paramount. In 1958, President Eisenhower created the Defense Advanced Research Project Agency (DARPA) to address this dilemma. However, even after DARPA, there was a time when the DoD deviated from this collaborative approach and decided to go it alone (or only with support of its most trusted integrators), typically producing poor, if not costly, results. Anyone remember the SME-PED [Secure Mobile Environment Portable Electronic Device]?<\/p>\n\n\n\n
Public\/private partnerships are a key component to the current administration\u2019s IT modernization initiative. Cloud and mobile are critical and, subsequently, have created the necessity for the DoD to foster similar partnerships.<\/p>\n\n\n\n
In fairness, the Pentagon must deal with many of the same issues that most enterprises struggle with: how to maintain a highly scalable, reliable capability while also providing the strongest, most transparent security model.<\/p>\n\n\n\n
The transparent part has been difficult.<\/p>\n\n\n\n
Solving the access dilemma<\/b><\/p>\n\n\n\n
The Common Access Card (CAC) has long been the primary identification method for all of DoD. It made perfect sense at the time of its implementation, given the high-profile breaches and the looming presidential directive. This involved issuing everyone (active duty, contractors, etc.) a plastic card that allows them physical access to a space and logical access to their computer and backend data sources. The CAC was modeled after existing smart card technology and fit the requirement at the time it was introduced. Access was based on \u2018something you have,\u2019 and something you know,\u2019 such as your assigned PIN. This worked fairly well, public key infrastructure (PKI) costs notwithstanding, for quite a while.<\/p>\n\n\n\n
Then mobile happened.<\/p>\n\n\n\n
There was no easy way to use a plastic card with a mobile device. The National Institute for Standards and Technology (NIST) and other agencies scrambled to resolve the disruption. A plastic card was not a long-term answer for logical access and identity from the modern endpoint.<\/p>\n\n\n\n
Derived credentials, or PIV-D, was the proposed path forward. PIV-D tried to solve a current, and rather large, identity and access dilemma by leveraging the existing investment in the massive PKI backend that supported plastic cards. Yet, there was a problem with this approach: PIV-D is just PKI 2.0. It doesn\u2019t solve the broader problem, which is that cloud and mobile have completely changed how employees work and access protected data. Also, PIV-D alone only offers a single factor login, increasing the risk of a breach if credentials are stolen or compromised.<\/p>\n\n\n\n
IT modernization is happening this time<\/b><\/p>\n\n\n\n
The good news is that there is hope. The public\/private partnership is alive and folks at NIST, the National Cybersecurity Center of Excellence and others have recently revised guidelines to help modernize, looking at open standards such as OAuth, Fast Identity Online (FIDO), OpenID and others to try and help solve this problem. Biometric identity authentication on a government-trusted device, and the use of a FIPS-validated hardware token like the Yubico Yubikey for replacement of a CAC or PIV card will make agency life easier on the path to IT modernization.<\/p>\n\n\n\n
The journey to modernize is also leading agencies toward a \u201czero-trust\u201d security model, first discussed and implemented in the private sector, but now gaining traction in the public sector. A zero-trust security architecture makes everything pass the same test(s) before a system trusts it and grants it access, regardless if it\u2019s \u201cinside\u201d your network or not. No matter where the user is, what device they\u2019re using, or where the application they\u2019re trying to access is housed (cloud or on-premises), they must pass the same security checks.<\/p>\n\n\n\n
IT modernization is about using COTS (commercial off-the-shelf) technologies and services to give agencies the ability to be more agile in deploying and managing their environment and get better security for the bargain. Whether you leverage your existing PKI (PIV-D) or not, you can layer on strong multi-factor authentication and tie into modern cloud technologies with ease.<\/p>\n\n\n\n
Technologies that support these standards are the way forward in not only allowing for quick fielding of open standards-based technology, but also future-proofing the access and identity conundrum we find ourselves in today.<\/p>\n\n\n\n
Sean Frazier is the advisory chief information security officer for federal at Duo Security.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
The journey to modernize is also leading federal agencies toward a \u201czero-trust\u201d security model, first discussed and implemented in the private sector, but now gaining traction in the public sector.<\/p>\n","protected":false},"author":7,"featured_media":39442,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":26,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,31,33,26],"tags":[],"coauthors":[7463],"class_list":["post-16612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters","category-opinions"],"acf":{"subheadline":"","legacy_arc_id":"WKXQPNTJZVFKHAFUQRY33ZWESY","arc_canonical_url":"\/opinion\/2018\/05\/31\/what-it-modernization-means-for-the-cac\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n