Identity authentication is absolutely necessary to conducting our affairs today. Without it, we would lose virtually all confidence to conduct business or create and foster relationships. But with ever increasing concerns related to data privacy, it is worth looking at the past to see what future challenges we may face in the digital identity space.
From Jewelry and Markings to Biometrics and AI
Unsurprisingly, identity authentication has gone from a slow evolution to a fast revolution. In ancient times, identity was usually authenticated by jewelry and markings, such as tattoos. These items verified familial ties, tribes, wealth and status within society. With the advent of writing, records could be kept and archived. Even those early records evolved and took different forms over time, standardizing themselves to include basic information, such as birth records, land title deeds and, in some cases, even citizenship.
Many of today’s identity-related documents have roots in the U.K. and other parts of Europe. For example, in 1414, King Henry V of England began to issue “Safe Conducts” documents, warning other countries to allow the bearers of these documents to travel freely. King Louis XIV of France granted travelers a document that allowed them to pass through a port freely, called a “passe port.” Now you know the origin of the word if you did not already.
It was not until the 19th and 20th centuries, however, that authentication really started to go into hyper drive. For thousands of years, we had physical items, markings and letters from a sovereign. Yet in a matter of 200 years, we came up with the following:
- Personally identifiable information (PII) linked to a unique number, something first seen in British policing reforms
- The photographic system, which would eventually integrate itself into forms of ID
- National ID numbers, first seen in the Netherlands
- Fingerprints used for precision identification
- Commercial two-factor authentication (2FA) — i.e., a bank card and PIN
- Smart cards
- Sophisticated biometrics, such as retina scans, facial and voice recognition, body movement detection and even heart rate verification
- Artificial intelligence (AI) and machine learning
The Ongoing Challenge of Information Collection
In a nutshell, for thousands of years, the problem could have been summed up like this: The means to collect the necessary information to accurately authenticate identity did not exist. Recent developments in digital identity technologies have turned the problem upside-down: The means to collect the necessary information to accurately authenticate identity not only exist, but are pervasive and ubiquitous.
Therein lies the data privacy problem: At what point does holding personal or digital identity data shift from being an asset to a liability? To answer the question, the problem cannot be viewed in a vacuum for a variety of reasons, including:
- Local laws and guidelines;
- Corporate policies;
- End user licensing agreements;
- Terms and conditions for product use;
- Global travel and trade, including jurisdictional authority;
- Where the data actually resides and which jurisdiction’s rules apply;
- Who owns the data, the individual or the information gatherer;
- What are “reasonable” levels of privacy, both in public and private spaces; and
- Expectations of users and handlers.
Based on the list of issues, the future challenges of digital identity will have little to do with technology. They will, in fact, be almost exclusively related to policy — and policy-related challenges are the hardest to answer, as they are often matters of opinion.
Even when policies are agreed to, they are hard to implement because they take time, may be hard to enforce and, perhaps most importantly, represent a sign of change that could bring about resistance. Any IT professional who has tried to deploy on new production or shift platforms knows all too well what that resistance looks like.
Is Easier in the Short Term Better for the Long Term?
Technological means to establish digital identity assurance certainly exist. You can provide continuous identity monitoring, use AI and machine learning, and take advantage of the scalable and agile solutions the cloud offers. All of these tools help improve user and customer experiences, but we are still dealing with an environment full of fraudsters and tricksters whose sole purpose is to circumvent any technological defenses in place.
So what is the short-term solution?
Because this is an issue that cannot conceivably be solved overnight, the immediate step to protect digital identity is checking up on your cyber hygiene. No, this won’t solve the long-term digital identity and authentication problems, but you want to deal with what you can today by nipping your existing issues in the bud.
Next, ensure your cyber resilience is up to snuff, which, by definition, is dynamic and needs a watchful eye every day. What you did yesterday will not necessarily be good enough today, and will almost certainly not be good enough for tomorrow.
Finally, begin to think about not only how you want to handle your risk today, but also how you think you may want to handle tomorrow based on current trends and the list of issues outlined above. Data privacy is a risk all organizations face today. Remember your risk choices:
- Risk acceptance
- Risk transfer
- Risk avoidance
- Risk mitigation
- Risk deferral
- Risk exploitation
The issue of data privacy is unavoidable because more and more people have realized that they have been impacted by some sort of breach. It is always difficult to get an exact pulse on what public sentiment is, but it is not unreasonable to suggest that an increasing number of people are beginning to care about their digital identity, and are increasingly fed up with what is going on.
Therefore, keep in mind that in the digital identity space, as technological innovation allows identity authentication to go in one direction, for a set of reasons that are not technically related, data privacy may be going in another. That means that protecting digital identity will increasingly become the means to protect your organization. And if digital identities cannot be reasonably protected, the related privacy concerns will alter how business and relationships are handled. The only question left unanswered, then, is how?
The post Will the Future of Authentication Run Into a Privacy Wall? appeared first on Security Intelligence.
