CISA And NSA Highlight Technology Gaps In New Guidance On Identity And Access Management

On October 4, 2023, the National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) published Identity and Access Management: Developer and Vendor Challenges, an advisory document developed by the Enduring Security Framework (ESF). The ESF is a CISA and NSA led cross-sector, public-private working group that works to address risks to U.S. National Security Systems and threats to critical infrastructure. This latest publication follows the ESF's advisory on Identify and Access Management: Recommended Best Practices for Administrators, released earlier this year.

The guidance identifies technological gaps preventing effective implementation of Multi-Factor Authentication (MFA) and Single Sign-On (SSO) technologies. Both MFA and SSO can provide increased security when properly constructed and integrated; MFA technologies can significantly strengthen the authentication process while SSO can "raise the authentication assurance level