NIST 800-63A IAL3 provides a fundamental framework for identity proofing, authentication and federated identity management. It defines multiple assurance levels, while formalizing multi-factor authentication to resist phishing attacks.

NIST 800-63A IAL3 provides updated IALs that aim to protect against scaled and targeted attacks, safeguard basic evidence falsification, theft and repudiation while supporting modern methods such as biometrics and identity wallets.

Authentication Methods

If you opt for the on-premises IAL3 route, be aware of its increased workload in terms of supply chain management, hardware configuration and physical security auditing. Furthermore, there's the risk that your IAL3 verification agent could be socially engineered into bypassing some steps.

Identity Proofing validates the real world existence of claimed identities, as well as confirm that those providing evidence represent them accurately. Furthermore, core attributes may be validated directly from identity evidence or self-asserted by applicants themselves.

At IAL3, identity proofing can be conducted remotely or on-site (including supervised remote processes), with or without the presence of a CSP representative. When conducting in-person identity proofing, collection of personal identifying information (PII) should be limited to what's necessary for resolution into an unique identity record; similarly, any attributes that assist resolution should only be collected if necessary to support risk-based decision making processes.

Authentication Time

At IAL3 (High assurance), a CSP must verify an applicant's claimed identity by directly engaging with them or remotely (supervised remote), using processes designed to safeguard both evidence presented and identity of its provider. These checks aim to avoid highly scalable attacks against basic evidence falsification techniques and social engineering tactics using compromised personal information, such as falsifying it. Representatives (RPs) can take advantage of CSP capabilities like providing only partial data instead of full datasets to reduce user burden.

The CSP verifies identity evidence presented by comparing it with information held or published by authoritative sources, or at the request of the RP, against an assertion it controls (provided the attributes match). Furthermore, it may provide an enrollment code directly to subjects via their mailing address, telephone number or email address for binding to an authenticator, or as notification of verification; any such codes provided must be reset upon first use.

Authentication Requirements

NIST 800-63A IAL3 identity assurance level 3 authentication guidelines provide three Identity Assurance Levels: IAL1, IAL2 and IAL3. Unlike other LOA standards, the NIST guideline specifically recognizes that agencies may choose their AAL independently from one another to suit specific mission needs while meeting business and privacy concerns along with security requirements.

NIST defines IAL3 as a process that "ensures that physical applicants' claimed identities match with real world identities through direct comparison of physical applicants against strong evidence, either directly or remotely." To be completed successfully, this step involves attending an in-person attended identification proofing session with CSP and verifying at least one biometric characteristic. Enrolling with CSP subscriber account as well as binding authenticators(s) are also mandatory steps of this process.

TrustSwiftly can support all the identity proofing steps necessary for NIST IAL3 verification by using Azure Active Directory, FIDO2 security keys and Windows Hello for Business as part of its solution. Furthermore, TrustSwiftly supports both IAL2 and IAL3 validation processes depending on individual scenarios requiring more or less stringency in validation requirements.

Authentication Reporting

The IAL3 process aims to limit more sophisticated attacks. This requires additional rigor by mandating live in-person attended IAL3 identity proofing sessions and biometric collection; this enables CSPs to detect more advanced evidence falsification, theft, repudiation and other social engineering tactics used.

IAL3 also stipulates the use of an impartial referee when dealing with issues pertaining to enrollment and identity proofing processes, so the RP can enlist their services if an applicant cannot meet expected criteria for an IAL proofing procedure.

A CSP must document its measures for maintaining the disassociability, predictability, manageability, confidentiality and integrity of personal information processed by its services. Reassessing privacy risks regularly should include impact assessments from any changes made to services; any updates should be communicated back through DIAS; as should questions around whether KYC/KBV compensating controls exist and are employed where relevant.