Trust and Federation
Federation seems like such a great idea. Do the work once to perform identity proofing and issue a single credential for the user to manage, then allow the use of this single credential to access multiple resources spread across the Federal government. Federation has worked well on social media – users link their accounts together and use a single username and password to access. Federation has also worked for government employees - their Personal Identity Verification (PIV) cards are accepted for many cross-agency uses. But even after significant investment of federation to support citizen interactions with the government, federated citizen credentials are still out of reach.
Federation requires trust. Trust that the party issuing and managing the credential met a standard at least as good as the relying party would have done. Trust that the party managing the credential isn’t collecting and using data about the user’s behavior in a way that isn’t acceptable to the relying party. Trust that when errors happen (and they will, both from honest mistakes and malicious actions) appropriate actions will be taken.
In the physical world, we are wired to determine trust based on appropriate introductions, and social and societal cues. We tolerate mistakes as human error. But in the electronic world, these cues are missing, and the speed and scale of transactions allow a malicious entity a significantly greater opportunity to exploit misplaced trust.
The electronic replacement for trust is policy and standards. Policy to identify the acceptable balance between usability, cost, and security. Policy to ensure that relying parties won’t face penalties beyond the initial loss of confidentiality if they accept federated credentials. Standards and independent audits to ensure that credential issuers implement agreed upon processes and protections. And standards that allow all of the players in the ecosystem to seamlessly communicate to achieve the desired goals.
Share on Facebook