The future of identity is reusable and distributed
GettyImages/ Yuichiro Chino
Connecting state and local government leaders
New distributed digital identity solutions give users greater control over their personal information and ensure much needed services reach the people they're intended to help.
When President Joe Biden issued an executive order to improve cybersecurity at the height of the COVID-19 pandemic, it put a spotlight on the government's efforts to secure the nation’s digital infrastructure. It also established identity access management (IAM) as a lynchpin in those efforts.
A number of developments—from fraudulent tax returns to new schemes to defraud state agencies of benefits and pandemic relief funds—pushed citizen identity fraud to new heights. As agencies rushed to limit the fraud with measures such as facial recognition technology, new privacy and efficacy concerns surfaced around identity management. State and local government agencies struggled to verify applicants, protect personal privacy and authenticate logins to efficiently deliver services to qualified residents.
The good news, if there is a silver lining to the pandemic, is that it has led CIOs and CISOs in the public and private sectors to realize that trust in identity is critical, and technology can solve for it.
A number of tools have shown encouraging results, but identity still has a number of pain points, especially in today’s remote-first environments. Emailing or texting codes to verify identity can disrupt the user experience, adding cost and friction.
A new approach to multifactor authentication can eliminate those pesky one-time codes texted or emailed to verify identity. It gives constituents greater control over their personal information, without it residing in a central database vulnerable to breach. It can also overcome loopholes in the first-generation facial recognition systems being used today, while giving users the benefits of using a distributed digital identity to create a portable digital wallet.
New distributed digital identity solutions ensure much needed services reach the people they're intended to help. WebAuthn -- a web-based API that allows websites to add token-based authentication to their platforms -- can make FIDO more usable, because it’s portable across devices.
Imagine if one government agency were to enroll a user, who then could use that identity across any other government agency, or even in a private-sector setting. That's where the future of identity is going. Real ID and the National Institute of Standards and Technology’s digital identity guidelines are becoming the de facto standards for identity proofing. NIST 800-63-3, offers a multipronged approach that includes not just document authentication or email validation, but a variety of different ways to prove identity, layering together different technologies to get it right up front.
Too many organizations still use passwords and outdated knowledge-based authentication questions that don’t make sense now that many users’ personal data has been breached. A government-issued identity document relying on biometrics such as facial recognition is much more difficult to fake. Using verified biometrics and an automated platform, organizations can verify identity with confidence in a second.
The ability to make that digital identity as portable as a driver’s license or passport is a key consideration. The technology is available, but not all platforms are the same. The vast majority scan IDs, extract data from the documents (perhaps validating the data) and use the face in the picture for future authentication. But to stop fraud, agencies must examine and question the document forensically.
Biometrics are a key enabler of this process, even if some biometric identification modes are not entirely ready for prime time. Everybody has a face or a voice, whereas not everybody knows the answer to all of the knowledge-based authentication questions, nor do service providers know what questions to ask for authentication. Facial recognition has demonstrated bias across several dimensions such as gender, ethnicities and age groups, but newer technologies are correcting those problems.
There are many ways to get started with distributed identities, running pilots parallel to daily operations without replacing them right away. Agencies can try conducting some A/B testing by putting one employee, new contractor or customer through a digital identity onboarding experience. They can test different kinds of authentication side-by-side to compare the legacy method to WebAuthn, a QR code or some other tool.
Reusable identity is here to stay. Users want simplified access and organizations can save millions in costs. Don't wait for a standard. The time to start is now.