National Strategy for Trusted Identities in Cyberspace 1

National Strategy for 

Trusted Identities in Cyberspace

VCAT Discussion | 2.8.2012

Jeremy Grant 

NIST
National Strategy for Trusted Identities in Cyberspace 2

Called for in President’s Cyberspace Policy Review (May 2009): 

a “cybersecurity focused identity management vision and strategy...that 

addresses privacy and civil-liberties interests, leveraging privacy-enhancing 

technologies for the nation.””

Guiding Principles

• Privacy-Enhancing and Voluntary

• Secure and Resilient

• Interoperable

• Cost-Effective and Easy To Use

NSTIC calls for an Identity Ecosystem, 

“an online environment where individuals 

and organizations will be able to trust each other 

because they follow agreed upon standards to obtain 

and authenticate their digital identities.”

What is NSTIC?
National Strategy for Trusted Identities in Cyberspace 3

Usernames and passwords are broken

• Most people have 25 different passwords, or use the same one over and 

over 

• Even strong passwords are vulnerable...criminals can get the “keys to the 

kingdom”

• Rising costs of identity theft

– 8.1M U.S. victims in 2010 at a cost of $37 billion (Javelin)

• A common vector of attack

– Sony Playstation, Zappos, Lulzsec, Infragard among dozens 

of 2011-12 breaches tied to passwords. 

The Problem Today
National Strategy for Trusted Identities in Cyberspace 4

The Problem Today

Source: 2011 Data Breach Investigations Report, Verizon and USSS
National Strategy for Trusted Identities in Cyberspace 5

Identities are difficult to verify over the internet

• Numerous government services still must 

be conducted in person or by mail,

leading to continual rising costs for state, 

local and federal governments

• Electronic health records 

could save billions, but can’t move 

forward without solving authentication 

challenge for providers and individuals

• Many transactions, such as signing an auto loan or a mortgage, 

are still considered too risky to conduct online due to liability risks

The Problem Today

New Yorker, September 12, 2005 Rob New Yorker, July 5, 1993 Cottingham, June 23, 2007
National Strategy for Trusted Identities in Cyberspace 6

Privacy remains a challenge

• Individuals often must provide more personally identifiable information (PII) 

than necessary for a particular transaction

– This data is often stored, creating “honey pots” of information for cybercriminals to pursue

• Individuals have few practical means to control use of their information

The Problem Today
National Strategy for Trusted Identities in Cyberspace 7

Personal Data is Abundant...and Growing
National Strategy for Trusted Identities in Cyberspace 8

Trusted Identities provide a foundation

Economic 

benefits

Improved privacy 

standards

Enhanced security

TRUSTED IDENTITIES

•Fight cybercrime and identity theft 

•Increased consumer confidence

•Offer citizens more control over when and 

how data is revealed

•Share minimal amount of information 

• Enable new types of transactions online

• Reduce costs for sensitive transactions
National Strategy for Trusted Identities in Cyberspace 9

Apply for 

mortgage 

online with 

e-signature

Trustworthy 

critical service 

delivery

Security ‘built-into’ 

system to 

reduce user error

Privately post location 

to her friends

Secure Sign-On to state 

website

Online 

shopping with 

minimal 

sharing of PII

January 1, 2016

The Identity Ecosystem: Individuals can choose among multiple identity providers and digital credentials for 

convenient, secure, and privacy-enhancing transactions anywhere, anytime. 
National Strategy for Trusted Identities in Cyberspace 10

Private sector 

will lead the 

effort

Federal 

government 

will provide 

support

• Not a government-run identity program

• Industry is in the best position to drive 

technologies and solutions

• Can identify what barriers need to be 

overcome

• Help develop a private-sector led 

governance model

• Facilitate and lead development of 

interoperable standards

• Provide clarity on national policy and 

legal framework around liability and 

privacy

• Act as an early adopter to stimulate 

demand

What does NSTIC call for?
National Strategy for Trusted Identities in Cyberspace 11

NSTIC National Program Office

• Charged with leading day-to-day coordination across 

government and the private sector in implementing NSTIC

• Funded with $16.5M for FY12
National Strategy for Trusted Identities in Cyberspace 12

Key 2012 NSTIC Implementation Activities

1. Establishment of the Identity Ecosystem Steering Group

 NIST Recommendations to be published mid-February

 New 2-year grant to fund a privately-led (.com or .org) Steering Group to 

convene stakeholders and craft standards and policies to create an Identity 

Ecosystem Framework

2. NSTIC Pilots Grant Program

 FFO recently published for $10M NSTIC pilots grant program

 5-8 awards expected by late summer

 Focus on addressing barriers the marketplace has not yet overcome 

“Make something happen that otherwise would not”
National Strategy for Trusted Identities in Cyberspace 13

Key 2012 NSTIC Implementation Activities

3. Buildout of NPO

 Hire key staff (tech, privacy, governance, pilots leads)

 Model: influence via active engagement in Steering Group and managing 

pilots

4. Coordinate Federal efforts for .gov adoption

 Government agency embrace of NSTIC is key to convincing nongovernmental stakeholders that the Strategy is viable

 Identifying agencies with potential killer apps and willingness to be early 

adopters
National Strategy for Trusted Identities in Cyberspace 14

We've proven that Trusted Identities matter

DoD Led the Way

• DoD network intrusions fell 46% after 

it banned passwords for log-on and 

instead mandated use of the CAC with 

PKI.

But Barriers Exist

• High assurance credentials come with 

higher costs and burdens

• They’ve been impractical for many 

organizations, and most single-use 

applications.

• Metcalfe’s Law applies – but there are 

barriers (standards, liability, usability) 

today that the market has struggled 

to overcome.
National Strategy for Trusted Identities in Cyberspace 15

Privacy

Privacy Enhancing 

Technologies 

(PETs) (i.e., zero 

knowledge 

proofs)

Model 

Frameworks for 

Privacy 

Protection

Business models 

to demonstrate 

viability of PET

Usability

Are there ID 

solutions that can 

automate 

authentication 

and simplify the 

user experience?

Can mobile 

solutions 

overcome 

challenges with 

tokens?

Presenting choice 

in a way that 

does not 

overwhelm

Security

Alternatives that 

can deliver the 

PKI model or 

something similar 

with “lighter 

weight” 

technologies

Analysis of weak 

links in commonly 

embraced 

identity and 

credentialing 

schemes

Liability

Model 

frameworks for 

Liability Allocation

Innovative ways 

technology might 

be able to 

mitigate liability 

risks

Interoperability

Lack of solid 

standards to 

enable 

interoperability 

between different 

credential 

platforms

Architectures to 

enable easy 

exchange of 

identity and 

credential 

information

Attribute 

exchange and 

linkage to 

credentials

Barriers help guide where Pilots, R&D are needed
National Strategy for Trusted Identities in Cyberspace 16

Questions?

Jeremy Grant

jgrant@nist.gov

202.482.3050