2.2 Background
All changes in this version
Title changed
Before · SP 800-116
Background
After · SP 800-116 Rev. 1
Background
Control changed
Before · SP 800-116
HSPD-12 mandates the establishment of a government-wide standard for identity credentials to improve physical security in Federally controlled facilities 2 . To that end, HSPD-12 requires all government employees and contractors be issued a new identity credential based on the FIPS 201 on PIV. Following FIPS 201, this credential is referred to herein as a PIV Card 3 . HSPD-12 explicitly requires the use of PIV Cards “in gaining physical access to Federally controlled facilities and logical access to Federally controlled information systems.” [HSPD-12] The PIV Card employs microprocessor-based smart card technology, and is designed to be counterfeit-resistant, tamper-resistant, and interoperable across Federal government facilities. Additionally, the FIPS 201 standards suite defines the authentication mechanisms as transactions between a PIV Card and a relying party. FIPS 201 does not, however, elaborate on the uses and applications of the PIV Card. This document provides guidelines on the uses of PIV Cards with PACS. The PACS technologies deployed in most Federal buildings are facility-centric rather than enterprise-centric and utilize proprietary PACS architectures. Historically, a security advantage was seen in not having the design of the security system published or readily accommodating substitution. For this and other reasons, many deployed PACS are not interoperable. Moreover,
1 In particular, whenever a PACS uses cryptographic mechanisms, FIPS 140-2 and NIST SP 800-57 may apply. 2 Federally controlled facilities as defined in Section 1D of OMB Memorandum M-05-24. http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf 3 Federal agencies may refer to PIV Cards by other names, for example, “identity badges” or “access cards”. In this document, all such credentials issued by an accredited PIV Card Issuer are called PIV Cards. lack of agency card technology standards and current credential numbering systems are the factors that limit interoperability across agencies. In other words, an identity credential issued by one PACS may not have the capability to be used by another. To enhance security and promote interoperability, it is essential to develop an efficient and cost-effective strategy to migrate PACS to standardized methods as defined in FIPS 201. The application of cryptographic authentication and integrity methods allows the security of authentication to be improved, the design of authentication to rely on open standards, and the need for secrecy regarding authentication to be concentrated on cryptographic keys. Full compliance with HSPD-12, and the use of PIV authentication mechanisms for access to Federal facilities and systems as required by HSPD-12, should be the principal goals of a department or agency implementation plan. Recognizing that implementation will take time, migration goals and plans should be developed to PIV-enable PACS installations, while meeting continuity of operations and resource constraints. Plans may include change management strategies such as:
+ The use of "multi-technology" readers, enabling a transition to the PIV-enabled PACS over time by allowing proprietary identity cards and PIV Cards to work side-by-side.
+ Retrofit or upgrade the existing PACS to use PIV Cards.
+ Coexistence of PIV-enabled and existing PACS in leased multi-tenant facilities.
Recommendation: The OMB Memorandum [M-08-01] requires that the credential issuance be accomplished by October 27, 2008 (or by the date specified in the implementation plan mutually agreed-upon by the agency and OMB). Agency implementation plans should be written to accomplish the goals of HSPD- 12.
After · SP 800-116 Rev. 1
HSPD-12 mandates the establishment of a government-wide standard for identity credentials to improve physical security in Federally controlled facilities 2 . To that end, HSPD-12 requires all government employees and contractors be issued a new identity credential based on the FIPS 201 on PIV. Following FIPS 201, this credential is referred to herein as a PIV Card 3 . HSPD-12 explicitly requires the use of PIV Cards “in gaining physical access to Federally controlled facilities and logical access to Federally controlled information systems.” [HSPD-12] The PIV Card employs microprocessor-based smart card technology, and is designed to be counterfeit-resistant, tamper-resistant, and interoperable across Federal government facilities. Additionally, the FIPS 201 standards suite defines the authentication mechanisms as transactions between a PIV Card and a relying party. FIPS 201 does not, however, elaborate on the uses and applications of the PIV Card. This document provides guidelines on the uses of PIV Cards with PACS. The PACS technologies deployed in most Federal buildings are facility-centric rather than enterprise-centric and utilize proprietary PACS architectures. Historically, a security advantage was seen in not having the design of the security system published or readily accommodating substitution. For this and other reasons, many deployed PACS are not interoperable. Moreover,
1 In particular, whenever a PACS uses cryptographic mechanisms, FIPS 140-2 and NIST SP 800-57 may apply. 2 Federally controlled facilities as defined in Section 1D of OMB Memorandum M-05-24. http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf 3 Federal agencies may refer to PIV Cards by other names, for example, “identity badges” or “access cards”. In this document, all such credentials issued by an accredited PIV Card Issuer are called PIV Cards. lack of agency card technology standards and current credential numbering systems are the factors that limit interoperability across agencies. In other words, an identity credential issued by one PACS may not have the capability to be used by another. To enhance security and promote interoperability, it is essential to develop an efficient and cost-effective strategy to migrate PACS to standardized methods as defined in FIPS 201. The application of cryptographic authentication and integrity methods allows the security of authentication to be improved, the design of authentication to rely on open standards, and the need for secrecy regarding authentication to be concentrated on cryptographic keys. Full compliance with HSPD-12, and the use of PIV authentication mechanisms for access to Federal facilities and systems as required by HSPD-12, should be the principal goals of a department or agency implementation plan. Recognizing that implementation will take time, migration goals and plans should be developed to PIV-enable PACS installations, while meeting continuity of operations and resource constraints. Plans may include change management strategies such as:
+ The use of "multi-technology" readers, enabling a transition to the PIV-enabled PACS over time by allowing proprietary identity cards and PIV Cards to work side-by-side.
+ Retrofit or upgrade the existing PACS to use PIV Cards.
+ Coexistence of PIV-enabled and existing PACS in leased multi-tenant facilities.
Recommendation: The OMB Memorandum [M-08-01] requires that the credential issuance be accomplished by October 27, 2008 (or by the date specified in the implementation plan mutually agreed-upon by the agency and OMB). Agency implementation plans should be written to accomplish the goals of HSPD- 12.