Government Technology

Emerging Standards for Identity and Access Management


September 22, 2005 By

Tod Newcombe
One of the biggest issues government faces today is the management of user identity and access to information in an increasingly intergovernmental world. Chip Felton, CIO for the New York State Department of Mental Health, outlined how the state is tackling the problem. He chairs the state CIO Council Committee on Technology, which has set the goal of developing standards for a federated approach to identification and access management (IAM) that leverages the state's existing enterprisewide infrastructure.

A federated solution is a much simpler approach to identity management, when compared to a centralized system. In the commercial sector, credit card companies, such as Visa and MasterCard, use a federated approach when it comes to managing the millions of users who have credit card accounts. Most experts in the public sector see federated IAM as the best solution to growing demands for cross-agency and intergovernmental information sharing.

Some of the technological components of a federated IAM system include: directory services, single sign-on tools, credentials, tokens, biometrics and federators, which are translators between legacy IAMs and new IAMs.

The standards that underlie these technologies include LDAP and SAML, which is a security assurance markup language, a sort of XML for IAM over the Web. SAML is a critical middleware, the glue that makes IAM happen. It has become the emerging standard that could make IAM a viable solution for state and local governments.

The benefits that a standards-based IAM can deliver include:
  • A simpler way to grant and revoke user access to information
  • A reduction in the number of sign-ons and passwords an individual must work with to access multiple systems and databases
  • Greater security when it comes to user access to information
  • The elimination of complex, bilateral data sharing rules and structures between different levels of government.
Not surprisingly, the current state of IAM in New York is a hodge-podge of standards and solutions. In a recent state agency survey conducted by the CIO Council, they found that:
  • There's no uniform process for establishing user identification
  • There's no regular recertification of identifications
  • There's no single identification process within an agency, which means too many workers are dealing with too many passwords
  • Passwords are the most common form of identification and access control
  • Some biometrics are being used for IAM
  • The amount of information being shared across agencies and governments is increasing significantly.
To put the proper focus on the situation, the CIO Council has drafted an "emerging enterprise strategy" for IAM. It starts with a Common Trust Model that sets policies and procedures for identity management and also establishes the proper process for issuing and revoking credentials for users. Second, it calls for an Enterprise Infrastructure and an Internal Agency Infrastructure for IAM, which includes directory services across legacy applications. Third, it establishes the Federation Layer, which is where SAML middleware will be applied to make federated IAM possible.

New York's CIO Council plans to issue a report on its strategic plan for IAM in October.


| More

Comments

Add Your Comment

You are solely responsible for the content of your comments. We reserve the right to remove comments that are considered profane, vulgar, obscene, factually inaccurate, off-topic, or considered a personal attack.

In Our Library

White Papers | Exclusives Reports | Webinar Archives | Best Practices and Case Studies
Improving Emergency Response with Digital Communications
Saginaw County, Mich., increases interoperability, communication and collaboration with a digital voice and data network, as well as modern computer-aided dispatch.
Reduce Talk Time in Your Support Center by 40%
As the amount of information available to citizens and employees grows each year, so do customer expectations for efficient service. Contextual Knowledge makes information easy to find, dropping resolution times and skyrocketing satisfaction.
Emerging Technology Adoption in Local Government
In a recent survey conducted by Government Technology, 125 local government leaders shared their challenges, benefits and priorities when adopting emerging technologies such as cloud, mobility and IP. Read how your jurisdiction’s adoption of technology compares to your peers.
View All

Featured Papers