2.2: Identity, Authentication & Authorization

Improve Identity, Authentication, and Authorization Controls

Other Information:

Information discovery requires a standardized approach to authentication so participating entities can validate and trust the identities of users attempting to log into their systems. Information holders have often created their own authentication services resulting in users requiring unique credentials for accessing different systems or networks. Using trusted, interoperable authentication services will minimize the number of required credentials, drive out unnecessary anonymity, and achieve efficiencies by eliminating stand-alone authentication services. Once user identities are authenticated, their unique attributes assist in determining if access to information is authorized. Both information originators and consumers share responsibility for using standard processes, attributes, and "rules of use" to support authentication and authorization decisions. Further, user attributes require dynamic management to inform these decisions, including provisions for agile updates and removal of user access. Greater policy and technical alignment across departments and agencies will enable implementation of interoperable capabilities that engender confidence and trust in the process of confirming appropriate users while also providing access to mission-relevant information.

Indicator(s):

Indicator:1

Content