FIPS-201 Failure

By: Brian Rhodes, Published on May 28, 2012

The security market is hungry for money. With security budgets shrinking worldwide, any glimmer of untapped sales sends manufacturers and integrators scrambling. Nothing carries more impact that sweeping government regulations, and as a result, when FIPS-201 (PIV) demanded government entities reform their identity credential use, many providers jumped at the chance. Unfortunately, more than a decade later, the security industry is still waiting for race to begin.

In this update, we examine FIPS-201 intent, identify where it has gotten sidetracked, and discuss if it will ever be a significant source of security spending.

History

FIPS-201 aims to standardize physical and logical credentials into a single format:

  • Applies to over 5.7 million Federal Workers and Contractors
  • Provide official response to requirements defined in HSPD12
  • It is a joint US Department of Commerce / NIST project

When introduced, the US Government gave everyone 5 years to comply. After multiple deadline moves and delays [link no longer available], it still has not been universally adopted [link no longer available]. This begs the question: "What went wrong?"

Barriers

The difficulty in pushing through FIPS-201 changes is not due to lack of awareness of the regulation itself. Rather, a host of other barriers have sidetracked adoption efforts:

  • Mass confusion understanding what FIPS-201 means: most people are waiting to be told how to be compliant.
  • Difficulty converging physical and logical identities: Getting parties to agree on compliance plans is tough.
  • Adoption required undeveloped technology: Compliant credentials and readers had to be designed first.
  • Unfunded mandates: Despite hard compliance deadlines, money was not budgeted to fund changes.
  • No enforcement beyond threats: While funding can be cut by non-compliance, real penalties are nonexistent.

Market Impact

A large integrator at PSA-TEC explained how his company geared up a major push for compliance in the government vertical, but various barriers prevented it from being a real market driver.

For example, a practical 'update' required to bring a 'legacy access control' system current to FIPS-201 standards is adopting credentials that meet ISO14443 communication standards. At the present time, this requires a type of card that mandates a 'read' range under 2 inches. In addition, FIPS-201 credential compliance requires a cryptographic 'self test' feature defined by FIPS-140. At current processing speeds, this activity takes almost a full second of continuous interface to 'read' a credential.

These requirements mean that government entities must replace all medium or long range proximity or magstripe technology readers protecting secured areas. In terms of real changes, this means a huge percentage of all installed card readers must be replaced. This does not even address the more specific data protection requirements applicable to the access control system itself, which may need to be substantially updated or forklift replaced to become compliant.

In spite of its far reaching impact, FIPS-201 compliance has not precipitated anything beyond incremental changes to most applicable access control systems. It is therefore difficult to gauge the overall effectiveness of FIPS-201. While directive's intent is smart, the case can be made that more fragmentation and confusion exist in the identity market now than before.

Future Market Driver?

The answer is: No, not it the way it was once expected. The lesson learned from this is that 'the cart cannot lead the horse'. No matter how sensitive the security market is in addressing these directives, if funding and enforcement are not concurrently made available they will be relegated into the heap of spineless legislation. Quite simply, government entities will not choose to spend money unless they are forced to or shown a tangible return on the expense. For many, FIPS-201 compliance simply becomes another check box on the '5-Year Strategic Plan' to be addressed at a later date.

Comments : Members only. Login. or Join.

Related Reports

Verkada Raises $80 Million, Triples Valuation To $1.6 Billion on Jan 30, 2020
Verkada's rocketing valuation continues. 9 months ago, they got a...
Pivot3 Mass Layoffs on Mar 27, 2020
Pivot3 has conducted mass layoffs, the culmination of grand hopes, a quarter...
Security Sales Course January 2020 - Last Chance on Jan 02, 2020
Notice: This is the last chance to register for the course. This sales...
Converged vs Dedicated Networks For Surveillance Tutorial on Feb 12, 2020
Use the existing network or deploy a new one? This is a critical choice in...
VSaaS Will Hurt Integrators on Aug 06, 2020
VSaaS will hurt integrators, there is no question about that. How much...
Fever Camera Sales From Integrators Surveyed on Jun 01, 2020
Fever cameras are the hottest trend in video surveillance currently but how...
IPVM To Disrupt Trade Shows With Launch of Online Shows on Mar 17, 2020
IPVM is launching Online Shows, a series of ongoing events that allow sellers...
Viisights Raises $10 Million, Behavior Analytics Company Profile on Dec 09, 2019
Viisights, an Israeli AI analytics startup marketing "Behavioral...
Costar Technologies / Arecont H1 2020 Financials Examined on Sep 16, 2020
Costar's financial results have been hit by the coronavirus with the company...
Milestone XProtect 2019 R3 'Centralized Search' Tested on Oct 30, 2019
Milestone has had problems over the last few years releasing significant new...
"Severely Impacted" Mercury Security 2020 Leap Year Firmware Issue on Jan 17, 2020
One of the largest access controller manufacturers has a big problem:...
Convergint Coronavirus Cuts on Mar 25, 2020
One of the world's largest security integrators, Convergint, has made a major...
AI Video Surveillance (Finally) Goes Mainstream In 2020 on Sep 03, 2019
While video surveillance analytics has been promoted, hyped and lamented for...
CANCELLED: IPVM Conference 2020 on Feb 13, 2020
CANCELLED, May 6th: We are canceling the IPVM September 2020 Conference and...
Disruptive Free Lead Generation Added To IPVM on May 15, 2020
IPVM has added lead generation for sellers, for free, disrupting the...

Recent Reports

Hanwha AI Object Detection Tested on Sep 28, 2020
Hanwha has added detection and classification of people, cars, clothing...
Favorite Access Control Manufacturers 2020 on Sep 28, 2020
200+ Integrators told IPVM "What is your favorite access control management...
New Products Show Fall 2020 Starts Tomorrow! on Sep 27, 2020
Tomorrow, IPVM's sixth online show will feature New Products from over 25...
OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
The Future of Metalens For Video Surveillance Cameras - MIT / UMass / Immervision on Sep 25, 2020
Panoramic cameras using 'fisheye' lens have become commonplace in video...
Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations are at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Norway Council of Ethics Finds Hikvision Human Rights Abuses "Ongoing" on Sep 23, 2020
Hikvision's involvement in "serious human rights abuse" in Xinjiang is...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...
Installation Course Fall 2020 - Save $50 - Last Chance on Sep 22, 2020
This is a unique installation course in a market where little practical...
SimpliSafe Business Security Launched Examined on Sep 22, 2020
SimpliSafe has launched "SimpliSafe Business Security" that the company...
FLIR CEO: Many New Fever Entrants "Making Claims That The Science Just Won't Support" on Sep 22, 2020
FLIR's CEO joins a growing number calling out risks with fever / screening...