Hey, tech marketers. Long-time listener, first-time writer. I’ve been in the game for a few decades and I’ve noticed something. We spend a ton of time on the front-end, making sure our marketing is on point, but sometimes we forget about what happens on the back-end.
Take my friends at Bredemarket, for example. In their August 11 post, “Identity Assurance Level 3 (IAL3): When Identity Assurance Level 2 (IAL2) Isn’t Good Enough,” they dropped a term—”Federation Assurance Level”—and then just… moved on. They never explained what it was. It’s like a wildebeest marketing consultant presenting a grand strategy to a wombat customer, then forgetting to explain how the wild ride actually works. So, let’s fix that.
The Federation Assurance Level (FAL) is a term from the NIST 800-63C standard. Think of it as a way to measure the security and trustworthiness of federated identity transactions. In plain English, it’s about how securely one system talks to another when a user logs in. When a wildebeest (marketing consultant) helps a wombat (customer) set up a federated login, the FAL is the trust stamp on the transaction. Here’s a quick look at the levels:
- FAL1: Basic Federation Assurance. At this level, the identity provider digitally signs the assertion. This proves the assertion hasn’t been messed with, but it doesn’t encrypt the data inside. It’s a good starting point for low-risk scenarios, like a wombat logging into a public forum or a news subscription site.
- FAL2: Intermediate Federation Assurance. This is where things get serious. In addition to the digital signature, the assertion is also encrypted. This protects sensitive information from being snooped on as it travels across the internet. This is a must-have for a wombat logging into something like a patient portal or a financial app.
- FAL3: High Federation Assurance. The top tier. At FAL3, a “holder-of-key” assertion is used, which cryptographically binds the assertion to a key that the user controls. This provides a very high level of confidence that the person logging in is who they say they are and prevents sophisticated attacks. This is for the most sensitive transactions, like a wombat accessing critical government systems or national security databases.
So, while we’re out there, building great customer experiences, let’s make sure our wildebeest-consultants and their wombat-customers are using the right FAL for the job. It’s not just about marketing; it’s about protecting the trust we’ve built.
Bredemarket 