Authentication with cloud, BYOD: It's complicated

UPDATE: This article has been updated to correct the date of NSTIC's origin.

The true foundation of enterprise authentication and access control is pretty simple: establish identity. This includes both human and machine identity.

As cloud services proliferate, the need for reliable authentication and access control methods also grows. This has led to the emergence of multiple authentication services (both on-premise and off-premise) from a variety of providers.

Besides cloud growth, other disruptors are emerging to help boost the need for authentication services. They include:

• The growth of mobile consumer devices (BYOD) in the enterprise.
• Legacy system challenges relating to change management, incident management, mobility and cloud integration, which grow increasingly expensive as systems interconnect.
• The growth and maturity of  authentication standards, including OpenID Connect, OAuth, Simple Cloud Identity Management, Security Assertion Markup Language and others. They have helped drive interoperability between internal and external identity systems.

Today, identity management often is conducted via a set of technologies, policies and enterprisewide standards that can be used to support trusted connections and interactions. As the number of IT services grows across an enterprise, government IT managers may find themselves evaluating a range of available identity technologies. It can be difficult to evaluate them all, but it's worth focusing on those that have the ability to deliver authentication services that are considered secure and scalable across a range of IT environments. They also should be easy to learn, use and administer (and not expensive to maintain).

To that end, government efforts are under way to standardize and simplify access control.

Growth of an identity ecosystem

One high-profile effort is the multiagency initiative called the National Strategy For Trusted Identities In Cyberspace (NSTIC). The group's goal is to accelerate progress toward interoperability between legacy identity management systems and trusted online credentials. Basically the initiative encourages the creation of a framework for an "Identity ecosystem." In most cases this type of solution will be created and maintained by contractors and system integrators.

The effort's goals, as outlined in the original April 2011 NSTIC statement, are lofty. But technical specifics for how the concept will become a reality are still in flux. The best way to see what's planned is to look at a set of pilot projects that received funding last fall. Each project takes a different approach for building and pilot-testing digital identity management across multiple systems. Each is working with a broad set of partners who bring their own specific tech solutions to the table.

Besides these initial projects, NSTIC managers have issued an Announcement of Federal Funding Opportunity to help develop additional on-line identity solutions that "embrace and advance the NSTIC vision."

Policy Machine to the rescue?

Government agencies may also want to take a look at the Policy Machine initiative that's under way at the National Institute of Standards and Technology.

The basic premise of NIST's Policy Machine is that each IT service on a government network usually is part of a set environment. Such environments typically include a server and its operating system, middleware and possibly a database and an associated set of database applications. Most of these systems have built-in solutions to help control execution of that system's capabilities and interactions with other systems and data. But they must be properly configured and maintained.

NIST's Policy Machine proposes a centralized way of setting rules for such interactions.

These types of services (or groups of integrated services) usually have a routine for identifying and authenticating the users of other IT systems that seek to connect and interact. Besides such authentication, the environment may include rules to limit which types of operations may be performed via each connection.

Because many such IT services exist as stand-alone environments, it can be a true challenge to develop enterprisewide access control policies and operational limits. Solutions must interact across multiple domains and control policies must be globally enforceable, which is difficult to coordinate.

The Policy Machine includes access control data and rules that can be used to set control policies and deliver computing capabilities when appropriate, including a set of functions for enforcing such policies. This helps an organization establish an enterprisewide operating environment that can "implement and execute capabilities of arbitrary data systems" according to the solution's description, and also "specify and enforce mission–tailored access control policies."

Policy Machine developers say, for example, that an e-mail application sometimes may distribute files to users regardless of an operating system's protection settings on those files. The Policy Machine can help properly set and enforce rules that will prohibit that from happening. It can be used to lessen the impact of the administrative, policy enforcement, data interoperability, and usability issues that enterprises face today.

AaaS on the move

Authentication-as-a-Service is gaining momentum. Companies such as Symantec, CA Technologies, RSA, Gemalto, Authentify, SecureAuth and SafeNet offer solutions of this type. Partnerships are developing to offer full ecosystems that government agencies can tap into, including new mobile solutions. But keep in mind that legacy systems will require agencies to take a mix-and-match approach for the products and services they need across an organization, especially if they want to manage federated identities and support correct multifactor authentication.

Also, context (and associated awareness of context) will play a role in user and device identities. For example, organizations may want to support single sign-on for end users who are working internally, but enforce other rules for users who are connecting remotely, or who are connecting through an unfamiliar device.

Government agencies that need to improve their identity management while expanding their cloud services would do well to familiarize themselves with the ongoing efforts of NSTIC, the NIST Policy Machine and the ongoing AaaS partnership ecosystems. These resources can help IT engineers sort out what is sure to be a very complex and highly individualized set of tasks.