Mastering identity security: A primer on FICAM best practices

For federal and state governments and agencies, identity is the crux of a robust security implementation. Numerous individuals disclose confidential, personal data to commercial and public entities daily, necessitating that government institutions uphold stringent security measures to protect their assets.

This need for robust security underscored by Executive Order 14028, published in May 2021, calls for enhancing the nation’s cybersecurity posture. The executive order highlights the importance of securing digital assets and mitigating cyberthreats by emphasizing the modernization of identity and access management (IAM) systems. Concurrently, the Federal Identity, Credential, and Access Management (FICAM) program has been pivotal in shaping the government’s approach to secure identity and access.

This article delves deeper into these principles, elucidates the advantages of deploying FICAM systems, and provides insights into best practices for implementation.

FICAM definitions

Federal Identity, Credential, and Access Management (ICAM) is a comprehensive framework of security protocols designed to aid federal organizations in managing, monitoring, and securing access to their resources. FICAM makes sure that only authorized individuals can access sanctioned resources for legitimate reasons, safeguarding organizations from unauthorized access attempts.

FICAM (Federal Identity, Credential, and Access Management) is an extension of ICAM protocols, methodologies, and systems for federal entities. It enabling them to regulate access to secured resources such as files, networks, servers, and physical locations.

Core principles of FICAM

ICAM security is built on three fundamental pillars: Identity, credentials, and access. In the following sections, we outline each concept and demonstrate how FICAM implements them

Identity management

Identity refers to a collection of attributes defining an individual. In a federal context, this typically encompasses personal or biometric information collected by agencies. Identity management is the orchestration of policies enabling organizations to establish, sustain, and delete user identities, crucial for verifying identities, managing user accounts, and maintaining accurate account records.

A key part of identity management is governance, which guides ICAM functions and activities, including analytics to identify security risks and non-compliance.

Credential management Credentials, in essence, substantiate an individual’s identity. Credential management enables organizations to issue, monitor, renew, and revoke access credentials, linking identities through specific logic, essential for account registration, information maintenance, and resource issuance.

Access management

Access management allows only authorized individuals to access resources or execute specific actions on them. Furthermore, access management principals encompass an operational component of Federation that enables agencies to accept identities, attributes, and credentials issued by others. This enhances interoperability and facilitates intelligent access decisions. It is pivotal for defining access policies and rules and determining permissions, authenticating, and authorizing users.

Goals of FICAM

FICAM outlines five strategic goals aimed at enhancing the security and efficacy of government technology experiences. These goals are also designed to facilitate compliance with federal laws, streamline access to digital government services, strengthen security and foster a trusted, interoperable and cost-effective environment.

FICAM architecture

ICAM segment architecture delineates how organizations should identify, authenticate, and authorize individuals from different segments, enabling trustworthy and

interoperable access to resources. It aids in improving security posture and efficiency, reducing risks of identity theft and data breaches, and strengthening protection of personally identifiable information (PII).

At its core, FICAM is a comprehensive framework for agencies focusing on enterprise identity practices, policies and information security disciplines. It provides a common framework for IT systems, apps and networks and informs readers of the standards and policies shaping FICAM.

Several federal laws, policies and standards govern the architectural principles behind the design of FICAM programs, including OMB Circular A-108, OMB 19-17, Executive Order 13883, and NIST SP 800-63-3. A full list of standards can be found here.

By leveraging IBM technology, you can implement the provided architectural sample to facilitate a FICAM deployment:

Figure 1. Reference FICAM architecture

The provided figure is a reference architecture to highlight necessary pieces about FICAM implementation. A singular policy enforcement and decision point is advised for consistency and standardization of access decisions. Security decisions can then be enhanced by leveraging either OOTB components of a provider or integrating with an existing solution present within the agency. These components can augment the FICAM architecture by providing capabilities such as multifactor authentication, endpoint device analysis and threat feeds from SIEM tools.

Getting started with ICAM and FICAM

To comply with policies and standards and successfully implement ICAM, consider these guidelines:

Avoid vendor lock-in

Choose a vendor like IBM Security Verify SaaS, whose solutions are based on open standards and can integrate with a myriad of partners, enabling interoperability with extensive integrations for robust identity and access management.

Implement multi-factor authentication

Multi-factor authentication mitigates the risk of access breaches and enhances confidence in the identity of each user. Enhance your security posture by implementing phishing-resistant methods such as passkeys delivered by FIDO Alliance and certified products such as Verify SaaS.

Incorporate adaptive access

Adaptive access, when paired with threat intelligence feeds, provides a robust defense against authentication attacks. This integration enhances both contextual analysis related to user logins and recommends informed access decisions based on calculated risk scores.

When evaluating any “adaptive” provider, take note of the quality of the recommendation generated by the system. It is not enough to gather “static” context such as a user agent type, geolocation, IP address risk and so on. Consider extending the context by evaluating biometric context such as typing speed, mouse movements and others. Most vendors offer static context, while few offer capabilities to detect biometric changes, or even detect VM virtual machine presence on an endpoint.

Use end-to-end attribute-based access control

This model of access control sets access privileges based on attributes, allowing admins flexibility over access policies, and effectively closing any gaps with security, data privacy and compliance. Consider pairing this with a privilege access management tool to further secure the most sensitive authentication information.

Secure access to APIs

To augment interoperability, deploy ICAM capabilities open standards such as OAuth2. Consider implementing API access management to secure these resources and fortify authentication.

By adhering to these guidelines and leveraging IBM Security Verify SaaS, organizations can enhance their security posture, maintain compliance, and safeguard sensitive information effectively.

Benefits of FICAM

Implementing FICAM enables federal agencies to address key security-related challenges. It provides a standardized framework to mitigate risks of identity theft and data breaches, facilitate compliance and connect federal agencies through federation and PIV credential compatibility to enhance security.

Leverage IBM Security Verify

Leveraging IBM’s identity and access management technology is pivotal for government or federal agencies implementing a Federal Identity, Credential, and Access Management (FICAM) program. IBM’s solutions are meticulously designed to integrate seamlessly with existing infrastructures, allowing agencies to enhance security without the need for extensive modifications to their current systems. This interoperability is crucial as it enables the enhancement of security measures without disruptions, especially in government settings where a range of legacy systems are often in operation. Additionally, IBM’s technology is adept at supporting modern protocols such as OAuth and FIDO2, helping agencies maintain security-rich, user- friendly access and uphold the integrity and confidentiality of data in diverse and evolving digital environments.

Moreover, IBM’s solutions provide extensive support for legacy environments, a feature that is invaluable for agencies still reliant on older technologies. This enables agencies to continue to use their existing systems while benefiting from advanced security and compliance features, allowing for a balanced, adaptable approach to security. Furthermore, the comprehensive support for Personal Identity Verification (PIV) and Common Access Card (CAC) credentials offered by IBM’s technology plays a crucial in the federal space. It facilitates secure and reliable access to sensitive information and systems, and gives agencies meticulous control over access, thereby protecting against unauthorized access and potential security breaches.

In essence, IBM’s identity and access management technology offers a multifaceted and adaptable approach to security. It enables government agencies to fortify their security postures, safeguard sensitive assets, comply with evolving security standards, and maintain operational efficiency and user convenience, within the diverse technological landscapes of government operations.

Explore IBM Security Verify