Improving authentication policy enforcement for government resources
summary
Government policy moves away from PKI‑only authentication toward a tailored mix of AAL and FAL choices, insisting on phishing‑resistant methods and semantic policy exchange at the protocol layer. Recommends using OSCAL JSON controls to automate control evidence, adopting OpenID Connect ACR and authentication method references plus proof‑of‑possession and mTLS to bind tokens, and pushing vendors to ship secure defaults (hide SAML, nudge toward modern federation) so systems scale without manual exceptions.
AI-written summary · about
chapters (10)
- 0:00Introduction by host
- 1:49Why focus on authentication policies
- 3:58Policy implementation challenges
- 7:09Modernizing system development lifecycle
- 10:00Tailoring assurance levels in AAL
- 14:43Moving beyond PIV exceptions
- 17:51Vendor support for tailored protocols
- 21:04Semantic profiles for authentication
- 24:37Next steps and vendor advocacy
- 25:37Q&A and closing remarks
related talks
30mInsecurity protocols: an overview of modern authentication
14mAPI access control strategies beyond JWT bearer tokens
26mHolistic Authentication
55mYou Shall Not Password: Modern Authentication for Web Apps
32mModern And Secure IAM For Modern Applications
19mAdvanced Authentication Framework
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
44mPresentation on Security Standards and Protocols