NIST 800-63-3 is a set of guidelines published by the National Institute of Standards and Technology (NIST) for digital identity management and authentication. These guidelines provide recommendations for digital identity proofing, authentication protocols, and federation models. NIST 800-63-3 is widely recognized as a valuable resource for organizations looking to improve the security of their digital identity systems and reduce the risk of fraud and identity theft.
It is also essential for government agencies because it works. For instance, state governments using solutions aligned with NIST Identity Assurance Level 2 (IAL2) standards saw a significant decrease in fraudulent COVID-19 unemployment claims. Whether adapting to changing mandates or incorporating industry standards such as NIST 800-63-3, Karsun has a solution to ease the adoption of security best practices during modernization.
The NIST 800-63-Standard
NIST 800-63-3 was released in June 2017. The guidelines were intended to improve online identity verification’s security and usability while addressing new threats and challenges that have emerged in recent years.
The guidelines are organized into three parts:
- Digital Identity Guidelines: Guides establishing digital identity proofing and authentication procedures.
- Authentication and Lifecycle Management Guidelines: Describes implementing and managing identity credentials and authentication.
- Federation and Assertions Guidelines: Provides guidance for federated identity systems and how to use assertions to share identity information between systems.
Since introducing NIST 800-63-3, these standards have become industry best practices for identity management. In addition to NIST 800-63-3 compliance, agencies are prioritizing Zero Trust as a key component of securing the User and App pillar. For example, the FAA’s 2022 AIT annual report states, “[its] network environment now operates within a Zero Trust security model, which requires users to be authenticated, authorized, and continuously validated to be granted access to a network, system, or application.” The agency’s cybersecurity-related improvement activities support the transition to Zero Trust, as well as its implementation of a new multi-factor authentication (MFA) service for users who would like to access the FAA’s network, systems, and applications.
Complementing Secure By Design Architecture
At Karsun, incorporating NIST 800-63-3 standards is part of designing secure digital architecture. Incorporating these guidelines into a secure by design architecture involves creating systems and applications with security considerations at every stage of the development process, from design to deployment.
The guidelines recommend using risk-based authentication (RBA) to assess the risk associated with each access attempt. We design systems and applications with RBA in mind and implement automated risk assessment tools to make real-time decisions about access requests.
Key to our solutions is NIST 800-63-3 adherent identity proofing. This process involves verifying user identities using multiple sources of data. We incorporate these guidelines into the design process to ensure that user identities are verified before granting access. We also consider federation and assertions. We integrate NIST 800-63-3 standards into the design process if the system or application interacts with other systems or applications.
In addition, NIST 800-63-3’s guidelines on digital identity proofing can help organizations implement identity verification procedures consistent with the zero trust principle of “never trust, always verify.” By using a risk-based approach to identity proofing, organizations can better assess the trustworthiness of each user and device and limit access to sensitive data and applications only to those users and devices verified to be trustworthy.
We design systems and applications with secure coding practices in mind and follow best practices for secure coding throughout development. In our implementation, we automated mobile testing via functional testing tools like Appium. We used code scanning and container image scanning tools to identify and mitigate vulnerabilities earlier and address those issues before deployment.
By incorporating NIST 800-63-3 guidelines and a zero trust framework into a secure by design architecture, agencies can develop systems and applications that are secure by default and can better protect sensitive data and resources.
Complexities to Implementing Authentication
While adhering to these standards is essential to building a secure application, it introduces added complexity to modernization projects. The standards specify appropriate authentication approaches based on different risk levels. Each has extensive rules, and the requirements for various authenticators may be overwhelming, unclear, ambiguous, and conflicting. Addressing each of these Authentication Levels across devices effectively can hinder the successful adoption of the security standards.
Identity Reference Framework
To meet this challenge, Karsun introduced an Identity, Credential and Access Management (ICAM) reference implementation. We customized the Keycloack open source tool via a specific Service Provider Interface (SPI) to address the complex NIST authenticator requirements while accelerating the adoption of those standards. Our team began with a risk based assessment, identifying the authentication workflows and their requirements based on risk level.
Next, using Keycloak, we created custom implementations for each workflow. Using these workflows, we created custom templates for new user sign-up forms. We also adapted these custom templates to adhere to US Digital Services (USDS) standards. This approach created a repeatable identify framework we could implement as a plug-in that can be deployed over an open source Keycloak container.
Not only does this approach reduce complexity, but it is also a more secure implementation. It allows the user, when appropriate, to use authentication other than a simple password. When using an authentication type such as FIDO2, the user enters a PIN or uses biometrics to authenticate successfully, then the authenticator uses the key in the device to sign the challenge from the identity provider. Thus the key never leaves the device. Using this highest-level-without-password/passwordless approach was more secure while simultaneously providing a better user experience.
Additionally, by using Keycloak to build our own identity reference framework library, we addressed a common concern with implementing open source tools. Using a template library created a clear separation between Keycloak and our ability to update the plug-in. We designed the library to keep the templates up to date and maintain the application’s security rather than relying on Keycloak itself.
Accelerating Identity and Access Management Adoption
Like many Karsun toolkit components, these identity reference framework resources are available to our team members to use through our InnerSource library. Evolving from an Innovation Center research and development project to a validated implementation, it can now be used as one of our readymade toolkits. All Karsun teams now have access to these vital resources and ensure that our teams can accelerate the implementation of emerging identity and ICAM standards in your agency’s modernization efforts.
Content from this post initially appeared from Pavan Kurkal as part of Karsun’s Monthly Innovation Town Hall series. These events present innovative solutions from our delivery teams across Karsun. Pavan is an engineer with the Karsun Innovation Center specializing in identity and access management.
HERNDON, VA – Karsun Solutions received a Top Workplaces 2023 Culture Excellence Award for Work-Life Flexibility. The list is based solely on employee feedback gathered through a third-party survey administered by employee engagement technology partner Energage, LLC. This confidential survey uniquely measures 15 culture drivers that are critical to the success of any organization: including alignment, execution, and connection, just to name a few.
“Earning a Top Workplaces award is a badge of honor for companies, especially because it comes authentically from their employees,” said Eric Rubino, Energage CEO. “That’s something to be proud of. In today’s market, leaders must ensure they’re allowing employees to have a voice and be heard. That’s paramount. Top Workplaces do this, and it pays dividends.”
At Karsun, a people-first culture drives collaboration. Its flexible roles, many of which have fully-remote options, empower teams to select the work arrangements that work best for them. Those teams located near its Herndon, Virginia headquarters offices may utilize onsite Innovation Center resources and co-working spaces as they build enterprise modernization solutions for their federal government customers. Remote teams may access the Karsun Konnect employee app for virtual training, career tools and chat with subject matter experts. Through Konnect, Karsun team members may also participate in virtual fitness classes and other employee groups.
“We are honored and proud to be among the companies leading the way in work-life flexibility,” said Kelly Demaitre, Karsun Solutions Chief People Officer.
Karsun previously received awards for its culture from Top Workplaces, The Oklahoman and employee-rating site Comparably. Most recently, it received Best Company Perks and Benefits and Best Company Outlook from Comparably. Shortly after winning its Perks and Benefits award, it announced enhanced paid time off and parental leave benefits. An information technology company hiring remote roles nationwide, it inspires future team members to “Find Your Next” at Karsun. Interested candidates may apply at KarsunCareers.com/jobs.
About Karsun Solutions
Transform your career with the company transforming possible for the government. Join the workplace where the only limit to your potential is the limit of your curiosity. Thrive in a community that empowers software development, cloud and data experts. At Karsun, explore every possibility and turn your bold ideas into reality. Expand your career potential with dynamic development resources like Karsun Academy and sponsored technical certification courses. And joining a growing enterprise means as we grow, so do your career opportunities. Take your career to the next level and play your part in powering new possibilities for federal agencies.
Media Contact: marketing@karsun-llc.com
About Energage
Making the world a better place to work together.™
Energage is a purpose-driven company that helps organizations turn employee feedback into useful business intelligence and credible employer recognition through Top Workplaces. Built on 14 years of culture research and the results from 23 million employees surveyed across more than 70,000 organizations, Energage delivers the most accurate competitive benchmark available. With access to a unique combination of patented analytic tools and expert guidance, Energage customers lead the competition with an engaged workforce and an opportunity to gain recognition for their people-first approach to culture. For more information or to nominate your organization, visit energage.com or topworkplaces.com.
Governments and corporations alike have adopted fleet electrification as a cornerstone of their plans to curb carbon emissions and head off climate change. As part of a pledge to make the federal government carbon neutral by 2050, an executive order from President Joe Biden targets an all-electric fleet by 2035. That is a fleet of 645,000 vehicles driving a whopping 4.5 billion miles a year.
Electric Fleets: Beyond Environmental Impacts
Among our fleet management projects, Karsun supports the modernization of GSA’s Advanced Fleet Platform. Karsun is proud to participate in this vital work preparing our nation for a changing climate. By using an electric fleet, governments can reduce their carbon footprint and help combat climate change. Electric vehicles also produce fewer pollutants than traditional vehicles, which can lead to improved public health. By reducing air pollution, governments can help prevent respiratory illnesses and other health problems associated with poor air quality. Moreover, electric vehicles can be powered by a variety of sources, including renewable energy sources such as wind and solar power. By using an electric fleet, the government can reduce its reliance on fossil fuels and increase its energy security.
Envisioning the Future: Empowering Local Communities
Fleet electrification is a unique opportunity to provide tangible impacts and community impact while addressing our changing climate. Federal agencies can lead by example and demonstrate their commitment to sustainability by committing to all electric fleets. This can inspire other constituents and localities to follow suit and make similar changes.
As an expert in both fleet management modernization and grants management, Karsun offers a unique opportunity for agencies to lead from the front on these initiatives. Our fleet and grants experts can help agencies modernize their systems to flow down grants to their constituents to accelerate the adoption of electric vehicles and other initiatives. Connect with us to learn more about our Fleet Management solutions or schedule a conversation with one of our enterprise modernization experts.
HERNDON, VA – Karsun Solutions, enterprise modernization experts, announced today it won the employer award from Comparably for Best Company Outlook. This is Karsun’s third consecutive outlook award from the employee rating site. Karsun Solutions transforms government through modern software development, cloud solutions and data solutions. Its acquisitions, aviation, grants management and fleet management solutions are implemented at federal civilian agencies.
The Best Company Outlook award honors the small and medium sized businesses with the highest employee confidence ratings on Comparably. The site hosts ratings and reviews from current employees of companies of all sizes. It determines honorees based on three measures: employee confidence about their company’s future success, how likely they are to recommend working there to a friend and if they are typically excited to go to work each day.
With just over a decade in business, Karsun’s outlook is strong in part due to its stable, ongoing growth. It is an eight-time Inc. 5000 honoree, repeatedly recognized for its industry leadership and innovative spirit. And at Karsun strong company growth becomes an opportunity for personal growth. This people-first approach excites innovators and collaborators and empowers employees no matter the stage in their career journey.
Karsun provides designated training hours and subsidized certifications for all employees. Karsun Academy, hosted through the in-house Innovation Center, presents workshops, bootcamps and training seminars introducing team members to emerging technologies and industry best practices. For those interested in applying their new knowledge, its Innovation Center practice areas connect team members to practice advocates which help them bring new solutions to life.
Karsun’s flexible, remote environment ensures teams may work in the way that best suits their needs. This is backed by a collaborative, open culture that includes directly interfacing with Karsun executives. It hosts monthly Coffee and Brunch with Leadership sessions. These small, informal groups invite two-way discussions about the future and vision for Karsun.
In addition to the Best Company Outlook award, Karsun previously received awards from Comparably for Perks and Benefits, Happiness and Culture. It is also a recent recipient of The 2022 Oklahoman Top Workplaces award. While most Karsun team members work remotely, many of its employees are based in Oklahoma City, Oklahoma and Washington, D.C. regions. Karsun is currently hiring for roles in these cities and remote roles nationwide at KarsunCareers.com.
About Karsun Solutions
Transform your career with the company transforming possible for the government. Join the workplace where the only limit to your potential is the limit of your curiosity. Thrive in a community that empowers software development, cloud and data experts. At Karsun, explore every possibility and turn your bold ideas into reality. Expand your career potential with dynamic development resources like Karsun Academy and sponsored technical certification courses. And joining a growing enterprise means as we grow, so do your career opportunities. Take your career to the next level and play your part in powering new possibilities for federal agencies.
Company Contact: Karsun Solutions, marketing@karsun-llc.com
About Comparably
Comparably (now a ZoomInfo company) is a leading workplace culture and corporate brand reputation platform with over 15 million anonymous employee ratings on 70,000 companies. With the most comprehensive data on large and SMB organizations in nearly 20 different workplace categories – based on gender, ethnicity, age, experience, industry, location, education – it is one of the most used SaaS platforms for employer branding and a trusted third party site for workplace culture and compensation.For more information on Comparably and its annual Best Places to Work Awards, visit www.comparably.com.
HERNDON, VA – Karsun Solutions announced today that it achieved Amazon Web Services (AWS) DevOps Competency status. This is the third AWS Competency designation for the IT modernization firm serving federal civilian agencies. In addition to the AWS Government Competency and AWS Migration Competency it already achieved, Karsun is also a Public Sector Partner (PSP) and participates in AWS Partner Network (APN) Immersion Days.
The AWS DevOps Competency designation recognizes companies helping customers implement continuous integration and continuous delivery (CI/CD) practices or helping them automate infrastructure provisioning and management with configuration management tools on AWS. Achieving the AWS DevOps Competency differentiates Karsun as an AWS Partner that provides specialized demonstrated technical proficiency and proven customer success with a specific focus on CI/CD, Monitoring, Logging and Performance, Infrastructure as Code, and Consulting. To receive the designation, AWS Partners must possess deep AWS expertise and deliver solutions seamlessly on AWS.
“The AWS DevOps Competency validates our commitment to implementing technology the right way to meet our customer’s mission,” said Terry Miller, President of Karsun Solutions.
AWS enables scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the AWS Competency Program to help customers identify AWS Partners with deep industry experience and expertise.
“Every solution from Karsun uses industry best practices applied to the latest advancements in technology,” said Badri Sriraman, Senior Vice President, Karsun Innovation Center. “We’re proud to be among the AWS Public Sector Partners that have achieved the AWS DevOps Competency.”
Karsun migrates, builds and optimizes in the cloud. Its expert DevOps teams introduce industry best practices using repeatable frameworks and playbooks which enable digital transformation at an accelerated pace. Its cloud architecture, platform and legacy application modernization solutions address agency needs today while preparing customers’ systems for the future.
An Advanced Consulting Partner, Karsun software development, cloud and data solutions teams all deliver on AWS. As an APN member with AWS Migration Competency status, its customers may utilize Karsun’s access to AWS Migration Acceleration Program (MAP) resources. When applicable, Karsun implements these financial incentives as part of AWS MAP. Its government customers may also leverage Karsun’s extensive experience modernizing large, complex systems with Cloud Runways, a portfolio of purpose-built toolkits optimizing migration to the cloud.
Learn more about Karsun’s AWS DevOps Practice at https://karsun-llc.com/solutions/cloud-solutions/aws-devsecops/.
About Karsun Solutions
Karsun Solutions modernizes enterprise systems enabling agencies to make the next technological advancement their next opportunity to elevate mission capability. IT solutions from Karsun are tailored to meet agencies’ unique needs and optimize operations. These solutions adapt and stay relevant with current trends while using secure, digital architecture built to last. It is a proven modernization partner whose expertise elevates agency capabilities and ensures every next opportunity is within reach.
Company Contact: marketing@karsun-llc.com
HERNDON, VA – Karsun Solutions, an enterprise modernization firm serving customers in the U.S. government, launched its new website Karsun-LLC.com today. The modern software development, cloud solutions and data solutions company’s website invites customers to use Modernization for Every Next as their agencies transform and adapt to meet changing mission needs.
Karsun’s information technology solutions support acquisitions, aviation, grants management, and fleet management modernization initiatives at federal civilian agencies. Karsun experts apply the latest technological advancements and industry best practices to address agency needs now while preparing their systems for future opportunities to modernize for mission success. This includes building secure systems based on an architecture built to last. Additionally, practice advocates and research and development teams within the Karsun Innovation Center ensure delivery teams have access to the latest technologies backed by experts in those tools with proven toolkits, assets and resources to accelerate their adoption.
Implementing emerging technology now while modernizing agencies for the next stage in their digital strategy has yielded consistent, ongoing growth for Karsun. As part of this growth, Karsun invites technology experts, team champions, builders and innovators to “Find Your Next” with the company. In addition to growing alongside eight-time Inc. 5000 honoree, future Karsun employees may find their next other ways. They may find their next inspiration through work with the in-house innovation center, their next collaborative community with a culture that supports team decision-making, their next opportunity to grow their expertise through Karsun Academy or the next opportunity to thrive in a flexible environment that encourages work-life balance.
As a remote-flexible employer, Karsun is hiring for nationwide roles and hybrid roles based out of its Herndon, Virginia, headquarters. Highly sought-after roles include full stack developer, data architect, software development engineer in test (SDET) and solutions architect. Interested candidates may learn more at https://www.karsuncareers.com/jobs.
About Karsun Solutions
Karsun Solutions modernizes enterprise systems enabling agencies to make the next technological advancement their next opportunity to elevate mission capability. IT solutions from Karsun are tailored to meet agencies’ unique needs and optimize operations. These solutions adapt and stay relevant to current trends using secure, digital architecture built to last. It is a proven modernization partner whose expertise elevates agency capabilities and ensures every next opportunity is within reach.
Company Contact: marketing@karsun-llc.com