Seven Identity Management Lessons in Seven Years

These are the seven lessons I have learned in the last seven years regarding identity management. Admittedly some are specific to the state and local arena, specifically first responder and critical infrastructure communities. What is your take?

1.) I do not care who you are. I do care WHAT you can and cannot do.
2.) Identity Management is only the beginning, in and of itself it is virtually worthless
3.) PKI is not the holy grail, the old saying Garbage in Garbage out is particularly applicable
4.) The FIPS 201 standard has done more to hurt State and local initiatives than it ha done to help them.
5.) The words de facto and standard are mutually exclusive.
6.) Interoperability cannot exist without governance and federation without governance is a myth.
7.) FIPS, FRAC, TWIC, CAC, PIV and BCC
US VISIT, ESAR-VHP, Real ID and TRIC
PASS, EPASS, IVS, CDL, SDL, IDIP and ACIS
It seems that identity has very many faces.
One more group of letters fits well on this list
S I L O
Common Platform is much to long and seems to have been missed!

 out of  found this valuable. Do you find this valuable?    

Hi, I am here from WPC. I will fix the problem.

 out of  found this valuable. Do you find this valuable?    

Show Last Reply

Can you discuss how Vuance can incorporate a mass evacuation scenario into the Raptor solution?

 out of  found this valuable. Do you find this valuable?    

Show Last Reply

Vuance is not just a credentialing company. We are a leader in smart card technology applications. Every day we hear from our clients concerned about the information required by the Raptor system for identity verification. People are concerned about identity theft and need reassurance about the extreme measures Vuance takes to protect their personal information. Individuals who are worried about the highly secure and encrypted Raptor System will likely make an internet purchase, sign up for a rewards or coupon program with the Grocery store or pharmacy, or without question provide their phone number and zip code as part of a credit card purchase, never mind the ease with which a mag stripe can be hacked or reprogrammed. These are old and vulnerable technologies that expose an individual to identity theft. The ASIS foundation and the Justice Policy Center Urban Institute released a report covering this and other topics. The full report can be found in the Downloads Section of this WIKI in the attachment list. The following is an excerpt from that report. We would like to use this thread to facilitate discussion on the use of smart card technology for frequency cards rather than the reports recommendation for elimination of them.
Pg-2 In the next five to 10 years, identity theft and fraud will continue to be the fastest growing crimes. However, the nature of identity theft is likely to shift to more organized, high-stakes, global attacks. To prepare, security managers should coordinate and share intelligence with all levels of law enforcement, invest in fraud detection systems, comply with standards for storage of sensitive data, and when possible, eliminate frequency cards
Pg-39 Frequency Cards: Reward cards that track the use or purchase of a product or service in order to offer a prize or discount for reaching a particular goal; often used by retail and services industries to encourage purchasing of merchandise and brand loyalty

 out of  found this valuable. Do you find this valuable?    

There is a movement to define professional qualifications for security personnel as well as to increase the utilization of these resources for both preventative and responsive domestic preparedness missions. There is a broad range of opinion on this topic with Sworn Law Enforcement having very strong opinions on this subject. This string is for discussion on this topic from the mission perspective and from the Professional Qualifications perspective. The ASIS foundation and the Justice Policy Center Urban Institute released a report covering this and other topics. The full report can be found in the Downloads Section of this WIKI in the attachment list. The following is an excerpt from that report.
Page 2: “Another terrorist attack will likely spur demand for security personnel. This need will
increase the challenges security managers already experience hiring qualified employees and
obtaining sufficient security clearances.
To assist with these obstacles, security managers should develop better working relationships with law enforcement and human resource
departments, and engage in efforts to further professionalize the security field.”

Page 16: “Recommendation • Increase the professionalism of the security field by establishing standards for employment with educational requirements and certification” Many states now require or allow private security (especially those carrying a firearm) to be defined a “peace officers” by state statute.
Vuance has undertaken a development project with Delaware State university which includes a credentialing component and research study on credentialing and professional qualifications. Building on DSU’s research team presentation, credentialing initiatives do provide a path to professionalizing a career field.

Reference sites include the International Association of Security and Investigative Regulators http://www.iasir.org/

 out of  found this valuable. Do you find this valuable?    

Just take a look at all of the standards and regulatory references on the links page. The shear volume is enough to confuse a seasoned politician or lawyer, and perhaps that is the problem. Should the government, specifically the bureaucratic behemoth that is DHS dictate what defines a credentialing system / accountability system / resource management system. Do we really have interoperability issues in the fire service or in EMS or law enforcement?
Let’s pick on the fire service as that particular group is near and dear to me being a former bucket head / rescue geek myself. In my neck of the woods the ten alarm card has worked just fine for more years than I have been alive. Countless times I have heard the argument from officers and firefighters alike that we personally know everyone who is likely to show up at our fireground and even if we do not know the individuals we trust the chief who is sending us the help. Why do we need an electronic credential to tell us about the person showing up at the scene? On the flip side you can argue that our traditional job has changed over the years. The fire service is deeper in to special operations like HAZMAT, US&R and EMS than ever before. We also live in an era where strike teams are not just part of major wildfire plans any longer, where disaster aid can come from across the country. I am not just talking about the high profile events, like WTC or Katrina either. Shouldn’t we be taking advantage of the “small world” concept? How about some of the normal non disaster issues. A trusted credential can be used to insure reciprocity between agencies across the country, right? An electronic credential can carry a medical record and information that could save the life of a brother who has gone down on scene, can’t it? How about supporting REHAB operations on the fire ground; is it not a benefit to have your base line vitals on your accountability tag?
Well?

 out of  found this valuable. Do you find this valuable?    

Show Last Reply

When using the 3.0 release of RAPTOR you may have chosen to scan images of pictures and documents through the use of third party software. Administrators need to remember to clear the contents of the folder after the information has been uploaded to the RAPTOR system. Once the images are in the Raptor system they are protected by several layers of security and encryption. Double check your my pictures, or my documents folders to make sure you are not accidently storing these images on your computer.

Another hint to tighten information security is to make sure you have the Microsoft AutoComplete feature turned off. If you have Internet Explorer 7.0 use the following steps
1.) Select tools (far right of the toolbar)



2.) Go to the Content Tab and click on the “settings” button in the auto-complete section


3.) All of the check boxes are selected by default, UNCHECK all of the boxes and then click on the “OK’ button where it says delete auto complete history.



4.) Check back often. I do not know why it happens but it seems as though every time windows loads an update the settings all revert to the defaults.

 out of  found this valuable. Do you find this valuable?