NIST Revises E-Authentication GuidelineNew Guidance Recognizes Technology Changes in Past 5 Years
Revised guidance from the National Institute of Standards and Technology could help organizations protect themselves from a growing threat to their information assets: the insider.
NIST Special Publication 800-63-1: Electronic Authentication Guideline expands the options for government agencies and other organizations that must verify the identity of users of their Web-based services. SP 800-63-1 updates guidance originally issued in 2006, and recognizes how technologies have changed over the past half decade.
"Changes made to the document reflect changes in the state of the art," Tim Polk, NIST Cryptographic Technology Group manager, said in a statement accompanying release of the report on Thursday. "There are new techniques and tools available to government agencies, and this provides them more flexibility in choosing the best authentication methods for their individual needs, without sacrificing security."
When first released, NIST said the authors of SP 800-63 assumed that most organizations would handle the business of figuring out if users were who they claimed to be in-house. But since that time, an industry has grown around providing authentication services, and agencies often take advantage of commercial systems or those of other government entities. Though passwords continue to be the leading mechanism for authenticating user identity, a growing number of systems rely on cryptographic keys or physical tokens.
The revision broadens the discussion of technologies available to agencies and gives a more detailed discussion of these technologies. The guideline applies whether agencies choose to handle authentication directly or leverage services provided by other parties, including commercial companies.
In the federal government, agencies can choose to use the services of companies that have had their authentication systems certified through the Federal Chief Information Officer Council's Trust Framework Provider Adoption Process, a program that assesses credentialing processes against federal requirements, including those established in SP 800-63. To ensure consistency and avoid redundant analysis, NIST said it strongly encourages agencies to leverage this process.
SP 800-63-1 is the official implementation guidance for the Office of Management and Budget Memorandum 04-04: E-Authentication Guidance for Federal Agencies.
Polk said the revised NIST guideline may inform but is not intended to restrict or constrain the development or use of standards for implementation of the National Strategy for Trusted Identities in Cyberspace, known as NSTIC (see Single Digital Password Credential Sought). NIST SP 800-63-1 is specifically designated as a guideline for use by federal agencies for electronic authentication. NSTIC, in contrast, has a broader charge: the creation of an identity ecosystem, an online environment where individuals and organizations will be able to trust one another because they follow agreed upon standards to obtain and authenticate their digital identities.