Cyber Security Means Locking the Front Door Too: Use High-Assurance Identity Management to Control Access to the Federal Bridge

Justin Oberman Vice President for Identity Strategy SureID

SureID Context In the physical world we We raise the bar for access before the bar is raised In the digital world we Extend the reach of IAM so that only cleared identities (“I”) get access (“A”) to be managed (“M”) In all worlds we Provide ongoing monitoring to mitigate vulnerabilities “between” checks 3

Identity Assurance Enables Outsiders on the Inside Assurance enables identity verification Verification makes intrusion much more difficult Locking reduces workload Ongoing Monitoring means access can be revoked in real time any time 7

PIV-I for CUI Overview: Benefits: Common, secure, reliable identification. Visual and electronic identify verification. Government-wide technical interoperability and authentication. Encryption of email messages containing sensitive and regulated information. Digital signatures for “official” corporate email correspondence. Digital signatures to make internal forms and processes “paperless”. Benefits: Non-proprietary, compatible, lower-cost COTS solution. Native support in products (e.g., Windows). Field proven and mature technologies. 6

SureID by the Numbers

AND MORE THAN 75,000 OTHER COMPANIES SureID Reach AND MORE THAN 75,000 OTHER COMPANIES 9

Users Click and Pay RELYING PARTY VENDORS/ CONTRACTOR/ OTHERS ACCEPTED BY ALL PARTICIPATING RELYING PARTIES DON’T PAY PAY ONCE 10

How Does Identity Assurance Work? PROVE IDENTITY & SCREEN REGISTER ADJUDICATE CREDENTIAL VALIDATE Web-based pre- enrollment Provide key biographical data In-person enrollment At retail location or mobile on- site Includes submission of photograph, fingerprints, identity documents as needed Conducted by trusted agent Review all background screen results Research every required record, e.g., when case disposition not available Trained/vetted adjudicators operating in a secure facility Credentials issued in person, via mail, or digitally ID verification required Includes PACS/LACS integration where required Identity Verification Validate documents Screen Criminal – name-based and FBI fingerprint- based Terrorism Connections Ongoing Monitoring Governs use of credentials to gain access Tailored to each operating environment Works with physical credentials, mobile verification, or biometric-only Register Prove Identity Screen Credential Validate Adjudicate Ongoing Monitoring 11