ID management's weakness: Few want to use it
Connecting state and local government leaders
The National Strategy for Trusted Identities in Cyberspace might be a good start toward establishing an effective way to manage online identities, but the test will be industry’s ability to produce secure, user-friendly technology and convince the public to use it.
The administration’s strategy for identity management is expected to be finalized this winter. It is an effort to bring some order to the task of managing identities and personal information in an increasingly online world. It is a worthwhile goal, but its success will depend on the ability of the private sector to provide effective, user-friendly tools to implement it and then convince the public to use it.
The National Strategy for Trusted Identities in Cyberspace has been under development for about a year as the result of the president’s Cyberspace Policy Review. One of the review’s recommendations was the “the federal government — in collaboration with industry and the civil liberties and privacy communities — should build a cybersecurity-based identity management vision and strategy for the nation that considers an array of approaches, including privacy-enhancing technologies.” A draft was released in June, and the final document is expected this winter.
The strategy will not be about technology, but about creating an “identity ecosystem” where “individuals, organizations, services and devices can trust each other because authoritative sources establish and authenticate their digital identities.”
The government will help to establish the framework to enable comprehensive scheme, but industry will have to make it work.
Related stories:
National strategy for identity management nearly done
Identity management a complex process with a simple goal
Doing high-assurance online authentication of identity is not terribly hard. There are plenty of systems using factors such as digital certificates and biometrics that can do it. The problem with identity management of any kind is making it scale. The user name/password combination is the default standard for online authentication, but in the few years it has taken the Internet to engrain itself in our lives, the complexity of this scheme has outgrown the ability of humans to handle it effectively. There are schemes to help manage or reduce the number of passwords but these can add their own complexities.
Non-password schemes using tokens and certificates can be simple on a one-off basis, but they don’t scale any better than passwords. The solution is something interoperable and flexible enough that a few sets of credentials can be used across the wide variety of transactions.
“The identity ecosystem should allow an individual to select the credential he or she deems most appropriate for the transaction,” the draft strategy said.
Developing this scheme would be a good trick, but it would still be just bits and bytes and some user-friendly hardware. The really good trick will be convincing consumers to use it, and the draft makes it clear that there will be a government mandate for that:
“Voluntary participation is another critical element of this strategy,” the review states. “Engaging in online transactions should be voluntary to both organizations and individuals. The federal government will not require organizations to adopt specific identity solutions or to provide online services, nor require individuals to obtain high-assurance digital credentials if they do not want to engage in high-risk online transactions with the government or otherwise.”
This means that the credentials, and the hardware and software needed to use them, must be convenient and inexpensive to consumers. They will have to be easier to manage than keeping track of a dozen passwords. And there must be an incentive to use them, which means that providers of online services will have to accept them.
This is not likely to happen right away. We can expect a period of some shakeout before a standard is settled on. Remember the confrontations between Betamax and VHS in videotape and between Blu-ray and Sony in discs. Millions of consumers had to either sit out the contest or risk ending up with a perfectly functional but practically useless system.
If the government and private sector can arrive at a combination of ease of use, interoperable standards and general acceptance, the national strategy will have done its job.
NEXT STORY: Cyber Command now fully operational