4/25/22, 12:26 PM blob:https://www.fdms.gov/bb1999e7-c2c0-4287-8d00-11951c66c25c

in their approach regarding identity management, authentication, authorization, and access control.

Systems and networks rely on assured and approved access to physical, electronic, and data assets ad the

ability to limit authorized users, devices, and processes. As a result, risk-based authentication solutions

(RBAS) were developed and commercialized in the market basing their software on the industry standards

and protocols regarding authentication:

Basing authentication on the following:

-Something you know (i.e., password): most common authentication method

-Something you have (i.e., smart access card): this form of authentication removes the problem of

forgetting something you know – but now an object must accompany you any time you want to be

authenticated

-Something you are (i.e., fingerprint):basing authentication on something intrinsic to the principal of being

authenticated

These three authentication components are very successful in managing access; however, the existing

commercial systems possess gaps when it comes to protecting access to data, electronic assets, entities

from both internal and external theft. For example, having access to a document management system via

single sign-on tools may not authorize you to download all information in the document management

systems especially document that are classified as secret and or sensitive. Current methods of accessing

data and electronic assets are based largely on 2 step verification or two step authentication which uses a

combination known (password) and a second factor. This process is limited in ability to access risk and

limits cybersecurity software developers in creating complete risk management approaches.

That said, Risk Secured System’s proprietary risk-based authentication and authorization solution

(RBAAS) is the only solution that goes one step further – incorporating an additional set on top of

something you know, something our have, and something you are. The RBAAS solution adds an

additional layer of protection based on someone you know or someone who knows you and can approve

your access in real-time to that classified resource or data asset. To expand, the benefit of this additional

step is an enhanced safeguard against both internal and external unauthorized access to secret or sensitive

data and assets within an enterprise’s data ecosystem. 

As a result, the NIST “Protect (PR) Identity Management, Authentication, and Access Control (PR.AC)”

should consider revamping its approach and understanding of traditional authentication protocols and

include an additional standard of approach when considering authentication methods. Additionally, this

additional layer of protection can utilize algorithm and proprietary classification databases in real-time to

provide access – thereby securing enterprise data and information systems from both known/unknown

users while offering a platform that provides an audit trail, escalation process, and compliance monitoring.

Attachments

Final - NIST Request for Additional Information (Ope Review)

blob:https://www.fdms.gov/bb1999e7-c2c0-4287-8d00-11951c66c25c 2/2