Secure identity

1
Secure identity a personal view

• Stephen Upton
• Office 020 8275 0102
• Mobile [phone]
• stephen.upton_at_btconnect.com

2
Digital Certificates or Electronic Identities?

• tScheme v tScheme2
• CP/CPS-defined service approval v Security Level
  (0,1,2,3) risk assurance
• Registration (RA) policy statements v
  real-world identity validation/verification
• Industry-led CA service co-regulation v
  e-Government service targets

3
HMG Minimum Standards HMGVInd

• Service-defined security levels (0,1,2,3)
• Face-to-face or remote Registration
• Types of evidence number of items
• personal statement
• unique details for cross-checking
• documentary evidence
• attributed ID and biographic ID
• third party corroboration
• professional or commercial referees
• existing relationship
• length x frequency of recorded interaction

4
Personal Identity challenges

• From Home Office ID Fraud report
• Identity authentication validation
  verification
• Attributed identity risks of document theft,
  forgery
• Biographic identity risks appear lower e.g.
  covert operations
• Biometric identity risks of untried scale,
  unreliable results
• at the Point of Issue verifying a real-world
  identity
• at the Point of Use authenticating an
  electronic identity

5
The evolving role of HMG

• Passive/Supportive - tScheme
• Enabling Gateway Intermediaries
• Active/Controlling ID Cards, Benefits push
• - perceived dependencies
• Trust
• Accuracy
• Accessibility
• Privacy
• Scrutiny

6
Ongoing issues trends

• Service intermediaries ? Data Brokers
• tScheme Approval ? PI Kite Mark
• RIPA ? consent-enabled Data Sharing
• Independent assurance ? regulatory control
• Online security ? offline privacy
• Federated identity ? consolidated identity
• Shared secrets ? joined-up secrets
• Risk control ? defensive intrusion

7
The challenges remain

• Registration security
• Data protection
• Objective, transparent, proportionate and
  non-discriminatory regulation
• Risk-based assessment
• Independent assurance

8
Conclusions?

• Travelling hopefully
• Reviewing the road map
• Changing drivers
• e-commerce
• e-government
• entitlement/identity
• Standards assessment What? How? Who?
• Arriving When? Where? Why?