1. NSTIC and the Identity Ecosystem Jim Sheire Senior Advisor NSTIC National Program Office, NIST 14 November 2012

2. Called for in President’s Cyberspace Policy Review (May 2009): a “cybersecurity focused identity management vision and strategy…that addresses privacy and civil-liberties interests, leveraging privacy-enhancing technologies for the nation.”” Guiding Principles – Privacy-Enhancing and Voluntary – Secure and Resilient – Interoperable – Cost-Effective and Easy To Use NSTIC calls for an Identity Ecosystem, “an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities.” What is NSTIC?

3. Usernames and passwords are broken Most people have 25 different passwords, or use the same one over and over Even strong passwords are vulnerable…criminals have many paths to easily capture “keys to the kingdom” Rising costs of identity theft 11.6M U.S. victims (+13% YoY) in 2011 at a cost of $37 billion 67% increase in # of Americans impacted by data breaches in 2011 (Source: Javelin Strategy & Research) A common vector of attack Sony Playstation, Zappos, Lulzsec, Infragard among dozens of 2011-12 breaches tied to passwords. Problems Today

4. Password change and New Account Setup are alienating customers 38% of adults sometimes think it would be easier to solve world peace than attempt to remember all their passwords 38% would rather undertake household chores, like cleaning the toilet or doing the dishes, than have to create another username and password Shopping cart abandonment: 38% online users do not buy online because they have to register before purchasing. (source: Forrester) Problems Today

5. Increased usage of e- signatures Trustworthy critical service delivery Security ‘built-into’ system to reduce user error Privately post location to her friends Secure Sign-On to state website Online shopping with selective sharing of PII January 1, 2016 The Identity Ecosystem: Individuals can choose among multiple identity providers and digital credentials for convenient, secure, and privacy-enhancing transactions anywhere, anytime.

6. Private sector will lead the effort Federal government will provide support Not a government-run identity program Private sector is in the best position to drive technologies and solutions… …and ensure the Identity Ecosystem offers improved online trust and better customer experiences Help develop a private-sector led governance model Facilitate and lead development of interoperable standards Provide clarity on national policy and legal framework around liability and privacy Act as an early adopter to stimulate demand What does NSTIC call for?

7. NSTIC Achievements Identity Ecosystem Steering Group (IDESG) launched in Chicago in August to craft standards and policies to create an Identity Ecosystem Framework Rules of Association Approved November 11, Governance in Place Focus turning to IDESG Working groups crafting key components of the Framework Convene the Private Sector Over $9 million in NSTIC pilot grants awarded Pilots will advance the NSTIC vision, objectives and guiding principles Will demonstrate innovative frameworks that can provide a foundation for the Identity Ecosystem, and tackle barriers that have, to date, impeded the Identity Ecosystem from being fully realized Pilot Grants Awarded Ensure government-wide alignment with the Federal Identity, Credential, and Access Management (FICAM) Roadmap New White House initiated effort to create a Federal Cloud Credential Exchange (FCCX), prospective bidders conference held August 2012 Government as an early adopter to stimulate demand

8. The Identity Ecosystem Steering Group (IDESG) Provides an open process for organizations to participate in the ongoing coordination, acceleration, harmonization and development of the Identity Ecosystem Framework Working Groups developing the overarching set of interoperability standards, risk models, privacy and liability policies, requirements, and accountability mechanisms that structure the Identity Ecosystem International Coordination Working Group meeting to address cross-border issues Website with registration information: www.idecosystem.orgwww.idecosystem.org Next Plenary meeting set for November 26-27 in downtown Washington, D.C.

9. What Your Firms Can Do TALK: about the value of NSTIC to leaders in your firm SUPPORT: NSTIC Pilots JOIN: the Identity Ecosystem Steering Group, attend next Plenary in Washington, D.C. Participate Leverage trusted identities to move more services online Consider ways to support identity and credentialing in partnership with trusted third parties Be early adopters You are a key partner, we want to hear from you Give us your ideas!

10. For More Information James Sheire James.sheire@nist.gov 202.482.1963 Twitter: @NSTICNPO, #NSTIC Blog: NSTIC Notes, http://nstic.blogs.govdelivery.com/