Complying with CJIS MFA Requirements

Whoshould read this? Enterprise identity architects,CISOs, IAM program leaders, and audit and compliance analysts for organizationsthat rely on Criminal Justice Information Services (CJIS) data.

Whatthey’ll learn: New CJIS requirements, timelines,how to address the needed changes, and how readers can benefit from an approachthat adds strong MFA credentials to existing systems.

It’s possible that no public organizationis a better example of the dramatic changes wrought by “digital transformation”than the FBI’s Criminal Justice Information Services (CJIS). What started in1924 as a small FBI division that collected and catalogued fingerprints hasbecome, on its one hundredth birthday, one of the most all-encompassing,complex, and critical law enforcement tools of the modern era.

CJIS is now responsible for providingprograms like:

• National Crime InformationCenter (NCIC and NCIC2000)
• National Instant Crime (NIC)background check
• Uniform Crime Reporting (UCR)
•  Integrated AutomatedFingerprint Identification System (IAFIS)
• National Incident-BasedReporting System (NIBRS)
• Bioterrorism Risk AssessmentGroup
•  Law Enforcement RecordsManagement Systems (RMSs)

Executive summary

• By October 1, 2024, anyorganization that accesses the FBI Criminal Justice Information Sytems (CJIS)must use multifactor authentication (MFA)
• This includes all state,county, and local police forces as well as justice departments and legal teams
• By CJIS definition the MFAsolution must meet NIST AAL2 standards
• The AAL2/3 standard recommendsthe use of either FIDO or PKI credentials (or both) to achievephishing-resistance
• The CJIS policy itself statesthe need for “Acceptance of PIV Credentials (PKI credentials), from bothOrganizational and Non-Organizational Users”
• The good news: thesecredentials and the security they provide can be added to many existing MFAimplementations

‍

Protecting vital data

Within the US alone, every state, regional,county, and local law enforcement organization participates in an interchangeof data with CJIS, providing new inputs and pulling in the data that helpssolve crimes.

While Law Enforcement’s dependence on thisdata has gone up, adversaries have aggressively targeted their systems to slowthem down, lock them up, or hold them for ransom. A few examples:

In May of 2023 the Dallas Police Departmentsuffered a ransomware attack by the Royal group that affected critical servicesand more than 30,000 accounts in 40 departments across 17 systems. It alsoexposed 1.2 TB of data and credentials.

In a prime example of a “digital feedingfrenzy”, the October 2023 loss likely led to a July 2024 announcement fromDallas County that another group – the Play ransomware group– had exposed datafor more than 200,000 people nationwide including social security numbers,medical information, health insurance details, and other data.

And this is trend is clearly not isolatedto Texas: in January of 2024 the Center for Internet Security (CIS) reportedthat malware attacks on government departments and agencies had increased by 148%, that government-targeted ransomware incidents were 51% more prominentduring the first eight months of 2023 over the same times in 2022, and thatdirect non-malware aided cyberattacks on these targets increased by 37%.

The CIS report states that these attacksresulted in a 313% rise in endpoint security services incidents like databreaches, unauthorized access and insider threats.

CJIS, as the nerve center of lawenforcement and government information, saw these trends in 2022 as a clear andpresent danger: they moved to strengthen systems and increase robustnesswherever their data was required.

‍

CJIS security policy updated

The latest version of the CJIS securitypolicy – version 5.9.5 – includes revisions that affect all entities who haveaccess to CJIS data, including education departments, police, interagencyteams, technology vendors and more. An article in Government Technology statesthese changes make the policy “roughly 50% new.”

Part of the policy’s “newness” was aninsistence on multifactor authentication (MFA) across all systems andapplications that store and access Criminal Justice Information (CJI). MFA as aprinciple recognizes that password-heavy authentication systems – let alonepassword- only systems – are a non-starter for strong authentication and accesscontrols. MFA requires the use of multiple factors for every authenticationattempt, including:

• Something you know, likepasswords, PINs, or security codes
• Something you have or possess,like smart cards, mobile devices, security keys, or tokens
• Something you inherently “are”,represented by fingerprints, facial scans, iris scans, or other biometric tools

Starting October 1, 2024, organizationsthat store and access CJI must have implemented MFA using at least two of thosefactors to authenticate sessions across all their systems and applications.Failure to comply with this requirement could lead to a denial of access toCJIS resources and data, which could be crippling for even the smallest oflocal police forces. (A list of requirements in the CJIS policy that explicitlyrefer to MFA is in this briefs’ end notes.)

The new CJIS policy also includes“prescriptive teeth” that define how MFA should be achieved. Unfortunately,it’s not as direct a reference as it could be, as the CJIS policy points toanother standard, the National Institute of Standards and Technology’s (NIST)four-volume regulation called SP 800-63 governing Digital Identity Guidelines.

Volume B of SP 800-63 covers“Authentication and Lifecycle Management” and spells out prescriptive detailsfor achieving MFA. Some practitioners and auditors who’ve been focused only onthe verbatim CJIS policies have already been caught flat-footed by thisdocument’s requirements for “phishing-resistant MFA.”

‍

Phishing-resistant MFA, according to NIST

MFA solutions as defined in the previoussection – those incorporating something you know, something you have,and something you are – have been around since 2016 or so. Why have they not stopped the flood ofgovernment attacks? In part because MFA has not been mandated, but also becauseauthentication factors are notcreated equal. There is a significant difference between passwords that can bestolen and then purchased for a few dollars per hundred (as in the DallasCounty case), versus strong certificate-based or FIDO-based credentials.

NIST SP 800-63 is the seminal document thatdefines the level of assurance required for different authenticators andauthentication mechanisms. “Level of assurance” describes the degree ofcertainty that a credential used for authentication is legitimate and correctlyrefers to the identity of the person using it. The new CJIS policy points tothis document for assurance standards; and these standards, in turn, point toNSTS’s 800-63B Authenticator Assurance Level 2 (AAL2) as a requirement.SP800-63B strongly recommends that when using MFA, AAL2 be achieved by using acombination of cryptographic devices and cryptographic software:

“A multi-factor cryptographic device is ahardware device that performs cryptographic operations using one or moreprotected cryptographic keys and requires activation through a secondauthentication factor. Authentication is accomplished by proving possession ofthe device and control of the key.”

In NIST’s explanation for AAL2 they say,“The multi-factor cryptographic device is something you have, and it shall be activated by either something you know or something you are.” This is also called“phishing-resistant” MFA because it provides security against widespreadphishing attacks that have been sosuccessful because of the en masse harvesting of knowledge factors like passwords, passphrases, and PINs.

NIST isn’t alone in recognizing the needfor phishing-resistant MFA. The US Cybersecurity and Infrastructure SecurityAgency (CISA) has a web page devoted to defining “phishing-resistant MFA” Inthis document CISA recommends that a broad swath of earlier forms of MFA – likeSMS-based authentication, voice-based systems, push notifications, one-timepasswords and one-time tokens – be discontinued. Instead, practitioners shouldupgrade these systems in favor of two far stronger, well-known methods: PKI andFIDO.

Phishing-resistant MFA, according to NIST

‍

Continued

A screen shot from CISA’s current guidanceon how to implement phishing-resistant, next-generation multifactorauthentication.

‍

While the CJIS policy points to NIST and SP800-63 as key reference, it does contain its own unique requirements forauthentication’s process and strength:

• CJIS 5.6: IA-5.n(9) “At enrollment, the CSPSHALL bind at least one, and SHOULD bind at least two, physical (something you have) authenticators…”
• CJIS 5.6: IA-5.(k 2) “…the ability torevoke or suspend the authenticator”.

Solution architects who design thesesystems (and the auditors who verify them) should keep both documents in mindas they ideate and evaluate their strong MFA.

‍

Strong CJIS authentication using PKI and FIDO

Public key infrastructure, or PKI, has beenaround as long as the internet. PKI is the “set of roles, policies, hardware,software and procedures” that “create, manage, distribute, use, store andrevoke digital certificates and manage public-key encryption.” PKI is thecomplex system that merges TLS certificates, certificate authorities, webaddresses, and devices into a secure and trusted relationship. CISA says“PKI-based MFA comes in a variety of forms; a well-known form of PKI-based MFAis the smart cards that government agencies use to authenticate users to theircomputers. PKI-based MFA provides strong security and is sensible for large andcomplex organizations.”

As complex and confusing as PKI can be, it isalso well-known and widely trusted. The process for creating and managingpublic and private certificates – called “transport layer” (TLS) or “securesocket layer” (SSL) certificates but all based on the X.509 standard – hasallowed the internet to support over 302 million certificates as of January 14,2024. Most enterprises have some sort of PKI solution in place to managetheir web properties, domain names, email and machine-to-machine connections.(Many, however, don’t want to be PKI specialists or manage their own PKI: seethe sidebar on PKI-as-a-Service.)

When used in conjunction with an MFAsolution, PKI-based MFA can be applied to the smart cards that governmentagencies use to authenticate users to their computers. It can be applied tohardware-based authenticators like those made by Yubico, Thales and IDEMIA. PKIcertificates can even be applied to dedicated end user devices, which is thetechnology behind email signing and device-based authentication.

As the CISA guidance states, “PKI-based MFAprovides strong security and is sensible for large and complex organizations.”

Passwordless FIDO passkeys representanother, different form of public key infrastructure. They are managed by theWebAuthn protocol and published by the World Wide Web Consortium (W3C).WebAuthn support is included in major browsers, operating systems, and smartphones. WebAuthn works with the related FIDO2 standard to provide aphishing-resistant authenticator.

Perhaps the most important thing toremember about FIDO is that it’s not supported everywhere: there are systemsand platforms and browsers that do not yet support advanced FIDO or WebAuthnstandards. Many of the legacy systems used for authentication into large andsmall government agencies do not yet support FIDO. For this reason, mostsuccessful implementations of strong MFA use both FIDO- and PKI-basedsolutions.

‍

Don’t rip and replace: how Axiad solves for CJIS requirements

Upgrading CJIJS policy standards in lightof unremitting, constant attacks is objectively a good thing. But most of theorganizations governed by CJIS – from state and country law enforcement tolocal police forces and legal firms – already have some form of MFA in place.

Are those departments and agencies expectedto rip and replace their authentication systems? Many IAM vendors would sayYes. But there is another way: Axiad Conductor.

Authentication systems have evolved frommonolithic one-size-fits-all solutions to dynamic, service-based solutions.These solutions can combine one or more technologies with an ecosystem ofproducts that include identity providers (IDPs), privileged access controls(PAM), machine-based identities like X.509 certificates, and hardware-basedauthenticators. In doing so they can come in alongside most leading IAMsolutions, like Ping, Okta, or Microsoft, and provide exponential value withoutincurring significant overhead in either cost or manpower.

Axiad Conductor provides an advancedauthentication toolset that combines the technologies needed to enhanceexisting multifactor authentication, with cloud-based PKI and robust credentialmanagement utilizing x.509 certificates and FIDO passkeys. It helpsorganizations deploy and manage strong authentication processes across people,machines and applications without replacing existing systems.

Axiad Conductor customers use anycombination of physical authenticators – like smart cards, digital tokens, phone-basedMFA, and hardware-based authenticators – and combines them with PKI-based orFIDO2-based credentials. The result is better phishing-resistant MFA that meetstough CJIS requirements with lower cost, happier end users, and fewer supportcalls.

To learn more about Axiad Conductor,download the product brief. Or you can call and speak to an integration expertwho understand CJIS requirements and schedule a demo.

Axiad’s PKI-as-a-Service

PKI has been the standard formachine-to-machine authentication for decades: it connects web servers to endusers, browsers to clients, and devices to systems and services. Butcybersecurity needs are ever-increasing, and some teams have had to short-stafftheir PKI groups to meet other security needs. And PKI requires no small amountof expertise and specialized knowledge.

Axiad Conductor can deliver AxiadPKI-as-a-Service: a consolidated, highly customizable, and scalable PKIsolution that provides the digital trust your organization needs totransparently secure end users, devices, emails, attached documents and all theconnections between these points.

The combination of product functionalityand a true SaaS delivery model lowers the cost of operating in-house PKI andallows organizations to consolidate or retire costly or aging PKI systems. Formore detail, visit PKI as a Service.

‍

‍

‍