National Strategy for Trusted Identities in Cyberspace. Enhancing Online Choice, Efficiency, Security and Privacy.

摘要

A secure cyberspace is critical to our prosperity. We use the Internet and other online environments to increase our productivity, as a platform for innovation, and as a venue in which to create new businesses. Our digital infrastructure, therefore, is a strategic national asset, and protecting it while safeguarding privacy and civil liberties is a national security priority and an economic necessity. By addressing threats in this environment, we will help individuals protect themselves in cyberspace and enable both the private sector and government to offer more services online. As a Nation, we are addressing many of the technical and policy shortcomings that have led to insecurity in cyberspace. Among these shortcomings is the online authentication of people and devices: the Presidents Cyberspace Policy Review established trusted identities as a cornerstone of improved cybersecurity. In the current online environment, individuals are asked to maintain dozens of different usernames and passwords, one for each website with which they interact. The complexity of this approach is a burden to individuals, and it encourages behavior like the reuse of passwords that makes online fraud and identity theft easier. At the same time, online businesses are faced with ever-increasing costs for managing customer accounts, the consequences of online fraud, and the loss of business that results from individuals unwillingness to create yet another account. Moreover, both businesses and governments are unable to offer many services online, because they cannot effectively identify the individuals with whom they interact. Spoofed websites, stolen passwords, and compromised accounts are all symptoms of inadequate authentication mechanisms. Just as there is a need for methods to reliably authenticate individuals, there are many Internet transactions for which identification and authentication is not needed, or the information needed is limited. It is vital to maintain the capacity for anonymity and pseudonymity in Internet transactions in order to enhance individuals privacy and otherwise support civil liberties. Nonetheless, individuals and businesses need to be able to check each other's identity for certain types of sensitive transactions, such as online banking or accessing electronic health records.