Smart Card Alliance publishes best practices for RF industry

It is time to crack the books. Our friends at the Smart Card Alliance Identity Council have released a guide to best practices in the RF identity management market — the idea being to ensure customer privacy while at the same time ensuring the integrity and utility of the cards. Almost as important from the alliance’s perspective is distinguishing between its RF member base and the RFID marketplace. “These new documents achieve a twofold purpose,” said executive director Randy Vanderhoof. “Providing rules for good behavior when using RF-enabled technology in identity management and clearly delineating the differences between RFID and contactless smart cards that use RF and provide security and privacy protection in identity applications.”

The alliance made the following recommendations:

BULLETS

- Implement security techniques, such as mutual authentication, cryptography and verification of message integrity, to protect identity information throughout the application.

- Ensure protection of all user and credential information stored in central identity system databases, allowing access to specific information only according to designated access rights.

- Notify the user as to the nature and purpose of the personally identifiable information (PII) collected - its usage and length of retention.

- Notify the user about what information is used; how and when it is accessed and by whom; and provide a redress mechanism to correct information and to resolve disputes.

“Adherence to these best practices not only helps ensure the validity, security and integrity of vital identity information, but at the same time addresses the concerns of citizens and government officials about privacy and the growing threat of identity theft,” said Vanderhoof.

-read more in this alliance news release