|
Identification cards have recently became a hot topic, especially since federal and state governments are looking for ways to confirm their workers' identities to give them access to the work facilities. Identifying personnel before access is granted will not only protect the physical resources such as the actual building, infrastructure and other facilities but will also sustain their computer network's integrity.
In recent months, two identification cards were successful in acquiring most of the publicity -- a transportation workers identification credential and the personal identification verification card based on FIPS 201.
These security measures, especially FIPS 201 cards will influence all federal recruits, close to 5 million individuals and a minimum of 2 million federal contractors. The convolution and the total quantity of cards needed will make this one of the biggest surveillance plans ever undertaken by the federal government.
All of these security concerns are being brought up by HSPD-12. It mandates the deployment of an interoperable solution for access to federal properties and IT networks by all federal agencies. The instruction also requires agencies to begin issuing FIPS 201-compliant certificates. In order to address the process, use and interoperability of the PIV cards the National Institute for Standards and Technology put in place the FIPS 201 standards. Establishing these standards will most definitely present a significant enhancement in the way federal government manages security access control systems relating to logical and physical resources. It has become critically important to have a standard security system to detect the identity of individuals. This will greatly enhance security levels, reduce identity theft, as well as increase government efficiency.
The Authorization Method
The government has put into action a three part system to enhance identity verification. First a sponsor must be found, then a registrar, and an issuer. This three step plan makes it very complex for any criminal to utilize fake data, produce a permit for an unauthorized personnel or modify an access card
Furthermore, prior to distributing any card, each and every contractor or worker is required to have a sponsor. This sponsor will typically be a supervisor or someone with a higher authority who can provide evidence for employment and other data pertaining to the worker's need for logical and physical admission to federal resources. The type of restrictions can be placed on times, specific sites, or days.
The next step in the process is finding the registrar. This can be a group or individual inside an outside vendor or agency permitted by the government to supply the required services. The registrar is responsible of gathering relevant information related to the registrants. This information includes data from the agency's human resources department and from the sponsor himself. Adding on, the registrar also will digitally collect a scan of the employee's 10 fingerprints as well as also, a digital picture of the applicant will be captured. A copy of the fingerprints will be turned over to the FBI or the federal Office of Personnel Management to carry out a criminal history test.
Upon the successful completion of the history check the issuer will pass the process. As mentioned before, the issuer can be an outside vendor or an interior bureau. The first step in completing the issuing process is to identify the identity of the anticipated card receiver via fingerprints. After that a Java applet will be added to the card by the issuer. A photo of the employee is also added and the card is finalized for printing. Several layers of designs, holograms, and hidden test are also added to the card in order to hurdle thieves from counterfeiting or duplicating the card.
As soon as a PIV card is issued the workers must slide the card through the scanner to gain entrance to their work area. They must swipe the security card one more time simultaneously as they place their finger on a biometric fingerprint scanner to verify their identity and attain admission to the computer network system of the agency.
A System for the Entire Government
Human resources departments can immediately deactivate identity cards, As soon as the employees leave the government employment. On the other hand as soon as new candidates are hired human resources can inform a sponsor to reinitiate the registration procedure again.
Numerous vendors, system integrators included, intend to provide full or partial solutions for card registration on the level of agencies or offices. A vendor must present its solution or products to NIST for evaluation and assessment in order to be eligible for the job. Among the top goals of General Services Administration is promotion of cooperation inside the actual agencies. For instance, in order to save paperwork, time and money, two or more agencies sharing the same building will be encouraged to share the same registration solution.
Although preparations for the new identification card have lately attained extensive media coverage, a recently released survey by a consulting firm for government procurement and contracting found that practically fifty percent of federal IT security executives did not create a practical plan in preparation for the upcoming deadline. This is mainly due to shortage of financial assets in the federal budget earmarked to pay for this ambitious project.
Nonetheless, HSPD-12 was successful in attend to a grave concern. A few agencies have already started pilot programs to employ HSPD-12. And it is estimated that the majority of governmental agencies used optional finances to instigate pilot projects prior to the Oct. 27 cut-off date.
The nation's ports also are hoping to improve security measures through the projected TWIC card, which will be delivered to each of the 750,000 longshoremen, railway employees, truck drivers, and those who access docks and shipyards on a daily routine. In late 2002, the administration was ordered by congress to come up with a tamper-proof photo identification card for port and other transportation employees. All individuals without access to secure locations of port facilities would be mandated to carry this identification card. August 2004 was the date that the first card was estimated to be issued. However, according to congressional investigators bureaucratic holdups and inadequate preparation reduced the card’s rate of development.
The Clear Route
The first cards issued costed employees $149 each and were legitimate for five consecutive years. In the best cases, companies will take care of the cost of the cards and the card readers and relieve the employees of this burden. The maintenance and installation and fees will normally be taken on by the ports and companies utilizing the credentialing solutions.
Prior to the issuing of cards by the TWIC of each worker will be conducted by the government. This background check will include a review of terrorist watch lists, warrants and immigration status, criminal records. Depending upon the facility's rated threat level, terminals and Shipyards will be required to update their criminal lists from the FBI on a daily or weekly interval. Adding on, similar to PIV cards, workers will have their fingerprints digitally implanted into the TWIC security network.
Once a port or shipyard employee obtains an access card, he or she must approach an access gate by walking or driving, and swipe his or her card through the device and while placing a finger on a biometric scanner. The security reader will validate that the fingerprint matches that embedded in the TWIC records. Each time that a worker passes through a gate a similar procedure will take place.
TWIC and FIPS 201 not yet flawless in their operation and general layout, but nevertheless, the two are a start in the right direction and a major step in the field of access control systems. The background checks and biometrically-embedded smart cards conducted by the government will greatly assist in confirming that the person seeking access to a federal office building, network computer, or port terminal is the person he or she state to be.
security, fingerprints, card, records, smart, biometric, network, computer, PIV cards
|
