Secure and Usable Enterprise Authentication:: Lessons from the Field

Area of Science:

• Information Security
• Human-Computer Interaction
• Public Administration

Background:

• Two-factor authentication (2FA) is crucial for securing sensitive government data.
• Personal Identity Verification (PIV) and Common Access Cards (CAC) are widely used identity credentials within US federal agencies.
• Assessing the practical impact of these technologies on user experience and security is essential.

Purpose of the Study:

• To evaluate the effectiveness of PIV and CAC for 2FA in real-world government settings.
• To determine if implementing PIV and CAC for 2FA enhances both system security and user convenience.
• To gather employee feedback on the usability of PIV and CAC for authentication.

Main Methods:

• Surveys were distributed to employees within the US Department of Defense and Department of Commerce.
• Data collected focused on user experiences with PIV and CAC for two-factor authentication.
• Analysis involved correlating authentication methods with reported usability and security outcomes.

Main Results:

• Employees reported improved usability when using PIV and CAC for two-factor authentication.
• The implementation of PIV and CAC for 2FA was associated with enhanced security perceptions.
• Feedback indicated a positive correlation between the use of these smart card technologies and overall satisfaction.

Conclusions:

• PIV and CAC are effective tools for enhancing two-factor authentication in federal agencies.
• The findings support the continued use and potential expansion of PIV and CAC for secure and user-friendly access.
• Optimizing the implementation of PIV and CAC can lead to significant gains in both cybersecurity and operational efficiency.