1. Federal Identity Management
The Future of
Federal Identity Management
Judith Spencer
Agency Expert - IDM
Office of Governmentwide Policy
GSA

2. What is ICAM?
ICAM represents the intersection of digital identities, credentials, and access control into one comprehensive approach.
Key ICAM Service Areas Include:
Digital Identity
Credentialing
Privilege Management
Authentication
Authorization & Access
Cryptography
Auditing and Reporting

3. ICAM Drivers Increasing Cybersecurity threats
There is no National, International, Industry “standard” approach to individual identity on the network. (CyberSecurity Policy Review)
Security weaknesses found across agencies included the areas of user identification and authentication, encryption of sensitive data, logging and auditing, and physical access (GAO T)
Need for improved physical security
Lag in providing government services electronically
Vulnerability of Personally Identifiable Information (PII)
Lack of interoperability
“The ICAM segment architecture will serve as an important tool for providing awareness to external mission partners and drive the development and implementation of interoperable solutions.” (President’s FY2010 Budget)
High costs for duplicative processes and data management

4. ICAM Scope
Non-Persons
Persons
Logical Access
Physical Access

5. FICAM Development Process
The development process involves coordination and collaboration with Federal Agencies, industry partners, and cross-government working groups.
The Roadmap team identified the key outputs of the Federal Segment Architecture Methodology (FSAM) needed for an ICAM segment architecture and coordinated these groups to develop workable approaches to enable cross-government solutions.
Interagency Security Committee (ISC)
Information Sharing Environment (ISE)
White House National Science and Technology Council (NSTC)
Committee for National Security Systems (CNSS)
Office of Management and Budget
National Institute of Standards and Technology (NIST)
Office of National Coordinator (ONC) for Health IT
Multiple agencies represented within the CIO council subcommittees and working groups

6. Components of the ICAM Segment Architecture
Performance Architecture
Outlines strategic vision for ICAM
Includes 32 performance metrics, 4 of which will be tracked on data.gov
Business Architecture
11 use cases representing high level government-wide ICAM functions
Supports IEE, G2G, G2B, and G2C scenarios
Data Architecture
Details data sources and elements supporting each use case
Illustrates the flow of information within the use cases
Service Architecture
Defines service types and components specific to ICAM
Supports the Federal Enterprise Architecture Service Reference Model
Technical Architecture
Comprise the high level vision of the technical architecture
Target state moves towards shared agency and federal infrastructures

7. ICAM Goals and Objectives
The Federal ICAM Roadmap addresses unclassified federal identity, credential, and access management programs and demonstrates the importance of implementing the ICAM segment architecture in support five overarching strategic goals and their related objectives.

8. Eleven Use Cases Covering:

9. Measuring Success

10. On-Going Activities
PIV Interoperability: Defining the parameters for an industry smart card that emulates the PIV credential
FIPS 201 is limited to the Federal community
External interoperability/trust is achievable
Trust Framework Providers and Scheme Adoption
Non-cryptographic solutions at lower levels of assurance
Industry self-regulation with government recognition
Working with Open Solutions to enable open government
Federal PIV deployment exceeds 70%
LACS deployment beginning
PACS demonstration system operational

11. Increasing the Trusted Credential Community
Back to Basics – M and NIST are still the foundational policy/technical guidance for identity management in the Federal government.
Establish unified architecture for Identity Management
Expand our use of Assertion-based solutions (Levels 1&2)
Stronger industry alignment for trust and technology standards
Federal Bridge interoperability will continue to play a role at Levels 3 & 4
Outreach to communities of interest
Explore natural affinities

12. M-04-04:E-Authentication Guidance for Federal Agencies
Assurance Levels
M-04-04:E-Authentication Guidance for
Federal Agencies
OMB Guidance establishes 4 authentication
assurance levels
Level 4
Level 3
Level 2
Level 1
Little or no confidence in asserted identity
Some confidence in asserted identity
High confidence in asserted identity
Very high confidence in the asserted identity
This synopsizes the four levels of assurance and some of the high level security controls at each level.
On-line with out-of-band verification for qualification
Cryptographic solution
Self-assertion
minimum records
On-line, instant qualification – out-of-band follow-up
In person proofing
Record a biometric
Cryptographic Solution
Hardware Token
Assertion-based
Crypto-based

13. Maximum Potential Impacts
FIPS 199 Risk/Impact Profiles
Assurance Level Impact Profiles
Potential Impact Categories for
Authentication Errors 1 2 3 4
Inconvenience, distress or damage to standing or reputation
Low
Mod
High
Financial loss or agency liability
Harm to agency programs or public interests
N/A
Unauthorized release of sensitive information
Personal Safety
Civil or criminal violations

14. Goals Leverage Industry credentials for Government use
Make Government more transparent to the Public
Make it easier for American Public to access government information
Avoid issuance of application-specific credentials
Leverage Web 2.0 technologies
Demonstrate feasibility with application(s) assessed at Assurance Level 1
Support applications at higher assurance levels as appropriate

15. Enabling e-Government
Business Process Redesign will result in standardized interfaces for logical access
Streamlined access control/provisioning
Well-understood Federated trust at multiple levels of assurance
Level 4 will require PIV-I
Levels 1-3 will recognize multiple solutions/identity schemes
Greater trust in external credential validity
Repeatable process

16. Summary
Identity and Access Management Are Foundational to Information Sharing and Collaboration
First release of Trust Framework Provider Approval Process and Identity Scheme Adoption Process available for public review
Industry Partners are Fielding Identity Credentials as well as Creating Federations for Sharing & Collaboration
Open ID Foundation
infoCard Foundation
InCommon Federation
Progress Depends on Public-Private Partnering 16