Advanced Authentication Requirement To Be Enforced
In 2013, the Criminal Justice Information Services (CJIS) Security Policy put Advanced Authentication (AA) requirements in place. To date, many agencies and organizations haven’t implemented this security requirement.
What is Advanced Authentication?
Advanced authentication requires the use of two of the following three factors of authentication: something you know (e.g. password), something you have (e.g. physical, like a hard token), something you are (e.g. biometric). The two authentication factors have to be unique (i.e. password/token or biometric/password but not password/password or token/token).
Advanced Authentication provides a greater level of security to any technology environment. A system or network protected by AA is much harder to compromise. Even if a hacker acquires or guesses a system or user password, they would still need to enter another security “factor” in order to gain access; one they simply wouldn’t be able to provide.
With the rise in security events directly targeting government at all levels and local law enforcement, the Montana Department of Justice will require any endpoint that connects directly or indirectly (including interfaces or mobiles) to the DOJ network to have advanced authentication installed by December 31, 2020. If an agency can’t meet that requirement and wishes to extend its AA deployment beyond the December 2020 date; they must apply for a waiver and submit a project deployment plan demonstrating when the agency will have AA in place within their environment. Any systems or endpoints after that date, except those that have received approval for an extension will be blocked from accessing the DOJ network or systems.
Please email the DOJ Security Team at DOJSecurity@mt.gov or call 406-444-2412 if you have questions on this requirement.
Advanced Endpoint Protection Requirement Impacts to Agencies – July 2019
Organizations today need advanced protection against an increasingly sophisticated cyber threat environment. Cybercriminals have become adept at finding new ways to infiltrate technology systems to cause disruption or harvest data. Regular anti-virus software can no longer easily identify these threats.
As a result, the State of Montana and the CJIS Security Policy are now requiring advanced endpoint protection on any device that connects to the Montana Department of Justice (DOJ) network.
By the end of 2019, the Montana Department of Justice will require any endpoint that connects directly or indirectly (interfaces or mobiles) to the DOJ network to have advanced endpoint protection installed. Because of the burden on agencies to meet this requirement, if the agency can’t provide this protection, MT-DOJ will purchase licenses (at the cost of $22.50 each per year) for any machine that connects to the MT-DOJ network to provide this additional layer of security and monitor these machines until an agency can get something else in place.
Please email the DOJ Security Team at DOJSecurity@mt.gov or call 406-444-2412 to get this process started for your agency.