by clicking on the page. A slider will appear, allowing you to adjust your zoom level. Return to the original size by clicking on the page again.
the page around when zoomed in by dragging it.
the zoom using the slider on the top right.
by clicking on the zoomed-in page.
by entering text in the search field and click on "In This Issue" or "All Issues" to search the current issue or the archive of back issues respectively.
by clicking on thumbnails to select pages, and then press the print button.
this publication and page.
displays a table of sections with thumbnails and descriptions.
displays thumbnails of every page in the issue. Click on a page to jump.
allows you to browse through every available issue.
FCW : August 15, 2013
ID management: Cloud 22 August 15, 2013 FCW.COM the SSA website, which would pres- ent a list of the third-party credential types the site accepts. The user would choose one of the third-party provid- ers and be redirected to the provider s login page to enter his or her creden- tials. The user would then be sent back to SSA s website. Lefkovitz said FCCX provides the hub through which the redirection between third-party providers and agency websites takes place. The relationships among the parties are streamlined: Each participating iden- tity provider and agency needs to do only one integration with the hub. The SSA scenario is merely an example because the agencies and applications that will participate in the FCCX pilot are still to be determined, she added. The hub is moving closer to real- ity, however. The FCCX Tiger Team began creating the conceptual foun- dation about a year ago. Now the General Services Administration pro- vides the program of ce that handles policy and governance activities, while the U.S Postal Service runs the FCCX procurement. A USPS spokeswoman said the agency will select a vendor for the cloud hub this summer. With FCCX on the way, that means many agencies rst exposure to cloud- based identity management will be on the public-facing side rather than an internally focused system that authen- ticates employees. That sequencing could prove popular because agen- cies that have already invested in on- premise identity management for employees might want to test the cloud on external users. Kenney said the preference is especially likely among agencies with extensive identity management sys- tems. "It is much easier to consider using a cloud service to take on new populations --- citizens, for example --- and comply with cloud- rst directives," he said. "Most organizations maintain separate repositories for employees and customers/citizens today anyway." That does not mean agencies will not use cloud-based systems to authen- The notion of setting up a service that multiple agencies can use for authentication is not exactly new, said John Bradley, senior technical architect at Ping Identity. He worked on the National Institutes of Health's iTrust identity solution, parts of which date back to 2003. Still, Bradley said, he is uncertain how the Federal Cloud Credential Exchange will fare as a shared service run by the U.S. Postal Service. "It still remains to be seen how much traction that actually gets across agencies, " he said. "Most of the agencies are still sort of focused on doing it in-house. " The important barrier might be economic rather than technical: Who will pay the cost of credentialing users, and how will that cost be distributed across participating agencies? The fate of FCCX might "hinge more on the...ability to distribute the load equally as opposed to any technology magic, " Bradley said. --- John Moore The economics of cloud-based ID management ticate federal users. Interior s RFI states that the agency seeks a SaaS- based identity management system that lets subscribers use the same creden- tials to access multiple resources. Tom Kemp, CEO of Centrify, said he is seeing growing interest in the company s cloud-based identity serv- ices products. More than 60 federal customers have deployed the compa- ny s on-premise identity management products, and the cloud-based wares are also "starting to get some adoption in the federal government." He said most of the company s discussions with agencies involve smaller projects, but a few are con- sidering enterprisewide deployments that would involve tens of thousands of users. "They are...looking to move into some SaaS apps and wanted to have cloud ID as well," Kemp said. Preserving users' anonymity Moving identity management, or por- tions thereof, to the cloud entails clear- ing a few obstacles. Kemp said adopters should consider whether an identity management solu- tion stores usernames and passwords in the cloud. He said Centrify performs authentication in the cloud, but users credentials are stored in an on-premise Active Directory system. He said buyers should also check to see whether SaaS vendors support open standards and protocols such as OAuth, OpenID and Security Assertion Markup Language. Lefkovitz, meanwhile, cited priva- cy as a key consideration for FCCX because sensitive credentials will be moving through the hub. "We want this hub to know as little as possible about what citizens are doing," she said, adding that FCCX also needs to ensure that identity providers know as little as possible to protect user s privacy. To preserve anonymity, FCCX will use numerical identi ers rather than usernames. The provider will send a numerical identi er to the hub so the hub does not know the user s identity. The hub then changes the number so the identity provider cannot determine the user s online destination and build a pro le around the user s activity, Lefko- vitz said. She added that NIST is working with industry on a second layer of protec- tion that involves a privacy-enhanced form of cryptography. She called the cryptographic com- ponent the most challenging piece of FCCX s privacy component. But the project s pilot status means that the hub can be evaluated and improved before it is widely deployed. "We are just trying to test it out and kick the tires," Lefkovitz said. ■
July 30, 2013
August 30, 2013