Category Archives: Uncategorized

Mic Drop — Announcing the New Special Publication 800-63 Suite!

More than a year in the making, after a large, cross-industry effort, we are proud to announce that the new Special Publication (SP) 800-63 IS. NOW. FINAL. With your help, Electronic Authentication Guidelines has evolved into Digital Identity Guidelines—a suite of documents covering digital identity from initial risk assessment to deployment of federated identity solutions. Check it out now at https://pages.nist.gov/800-63! Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , | Leave a comment

REGISTER NOW – Privacy Risk Assessment: Prerequisite for Privacy Risk Management Workshop

We are pleased to announce the next workshop in NIST’s ongoing series on privacy engineering and risk management – Privacy Risk Assessment: A Prerequisite for Privacy Risk Management, to be held in Gaithersburg, Maryland, on June 5, 2017. Registration is open now! Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , , | Leave a comment

A minor plot twist: Comment period extended for PART of SP 800-63-3

Let’s get this out of the way right up front: this is not an early April Fools Day prank!

Granted, government blogs aren’t the typical medium for getting emotional. But we (Paul and Mike), and the rest of our incredible team at NIST, have truly been moved by the support, encouragement, and engagement you’ve provided as we embarked simultaneously on this major update to the document and – perhaps even bigger – updating our community engagement process to achieve a better result on this document. Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , | Leave a comment

Closing time! You don’t have to go home … but you can still comment on draft SP 800-63-3

Just 15 days remain in the comment period for draft Special Publication (SP) 800-63-3: Digital Identity Guidelines! The document opened for public comment on January 30th and will close on March 31st. Based on the comments we’ve received so far, we don’t expect to extend the deadline, so get to work and submit your comments before closing time! Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , | Leave a comment

Build Trust and Verify: New funding opportunity to assess our state pilots!

Last year we issued five grants so state and local jurisdictions could use digital identity technologies to improve delivery of services.

Now, we want to evaluate how well those pilots have done: we’re issuing a new funding opportunity to quantify the benefits these solutions bring to the organization and end users, share lessons learned, and shed light on how successfully similar solutions can be adopted elsewhere, in public sector programs and services at all levels of government. With so many individuals depending on state and local government services for day-to-day activities, these entities can play a critical role in advancing digital identity for large populations. The findings, discoveries, and lessons learned from this funding opportunity will help pave the way for NIST to better inform and improve upon broader cybersecurity efforts in the future. Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , , , , | 2 Comments

From public preview to public draft: SP 800-63 is open for comment!

Don’t recognize us? We have a new blog theme! The NSTIC Notes blog is now I Think, Therefore IAM: a digital identities blog. Check out our latest post, below!

Last summer’s efforts on draft SP 800-63-3: Digital Identity Guidelines paved the way for a lot of positive changes – thanks to all who provided feedback. Today we are excited to announce the next step: the official public draft of SP 800-63-3 is out, open for public comment, and we’re anxiously awaiting more great feedback. The public draft will have a 60-day open comment period, closing on March 31st. Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , | Leave a comment

Making Privacy Concrete (Three Words Not Usually Found Together)

Most in the IT space won’t know this, but NIST has one of the world’s best concrete engineering programs. Maybe we just have concrete on the mind since a couple of us in the office are doing house renovations, but with today’s publication of the NIST Internal Report 8062, An Introduction to Privacy Engineering and Risk Management in Federal Systems (NISTIR 8062), we are taking a page from the concrete folks’ book with a document that we believe hardens the way we treat privacy, moving us one step closer to making privacy more science than art. NISTIR 8062 introduces the concept of applying systems engineering practices to privacy and provides a new model for conducting privacy risk assessments on federal systems. Continue reading

Posted in Uncategorized | Tagged , , | 7 Comments

2016 Year in Review: (TIG-ing stock of) Innovation in the Identity Ecosystem

When you think about 2016, the first thing that comes to mind is innovation in the identity ecosystem. That can’t just be us, right? While there has been a host of high-profile bad things that happened in digital identity this year, we try to keep our eyes on the prize. And there’s been a lot of progress toward the long-term goal. Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , | Leave a comment

SOFA Talk: Strength of Function for Authenticators Framework Now Open for Comment!

Back in January, NIST’s Applied Cybersecurity Division hosted the “Applying Measurement Science in the Identity Ecosystem” workshop. Among the knotty issues under consideration, 220+ participants discussed the concept of measuring the strength of authentication. Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , , | Leave a comment

Got trust? Seeking public comment on new NIST publication for developing trust frameworks to support identity federation

Some communities and organizations that share common user bases and transaction types are addressing challenges to users’ privacy and security by allowing users to access multiple services through common login processes. This approach – known as federated identity management – enables users to access multiple online organizations and services through shared authentication processes, instead of authenticating separately with each service provider. Continue reading

Posted in Uncategorized | Tagged , , , , , , , , , , , , , , , , , | Leave a comment