Cybersecurity

4 principles for securing the digital identity ecosystem

A digital 'passport' that provides universal access online might one day be a reality.

A digital 'passport' that provides universal access online might one day be a reality. Image: Levi Ventura/Unsplash

Colin Soutar
Managing Director, Cyber Risk, Deloitte
  • With services increasingly digital, proving identity online remains critical.
  • Cross-system use cases require a common meaning of trust.
  • Increased security and confidence in identities can incentivize greater participation.

When we travel through airports with passports that allow us to enter countries, it is sometimes easy to forget all the underlying steps that went into establishing trust between the issuing and the receiving countries. At a minimum, there’s the international standardization definition of a “neutral expression” for the facial recognition software; the passport’s machine-readable zone that carries our biographical information; the interface characteristics of the on-board chip; and, most importantly, the processes used to initially identity-proof the owner and their rights to the passport, and the subsequent authentication steps used to verify that they are in fact the one presenting the passport at airports and borders.

Just as a physical passport provides ease of movement, imagine the convenience of having your own digital identity “passport” you can present every time you want to access a new online service, without providing all the usual personal information and creating a username password, and other authentication factors. But while the online world – increasingly pervasive due to the global pandemic – does not require any standardized physical documents, identity-proofing and authentication are becoming inexorably more complex as users try to access a broad range of services and benefits without any direct, in-person interaction. For transactions of a single purpose, either in commercial or government sectors, self-contained identity solutions are nowadays often robust and easy to use. The challenges start to arise when we leverage credentials created by one system for use on another.

Have you read?

Why is this so hard? At the heart of the challenge lie two important inter-related considerations: trust and incentive. With travel documents, an issuing country has the incentive to allow its citizens to travel to other countries, and both countries have agreed on the operating conditions for the passport – so there is mutual trust. Securing the digital identity ecosystem matters because it can help to establish the basis for such trust online: among service providers, identity services, and – most importantly – users who will drive the commercial and government transactional engines.

This trust needs to be aligned, though, with incentives for the various parties. For example, users who manage and reuse their identity credentials like passports would likely be incentivized to drive greater online economic growth due to more convenience and confidence. Further, if commercial identity providers are incentivized to enable users to reuse credentials to access a multitude of services, then that helps limit the amount of unnecessary, replicated online personal information that consumers are required to provide. This would mean overcoming any liability concerns between the parties, or the natural tendency for organizations to want to retain information about their customer base for their exclusive use.

The 4 governing principles of digital identity
The 4 governing principles of digital identity Image: Deloitte

While there is still much work to be done around these considerations, the international trust aspect of digital identity is rapidly maturing. Based on supporting programmes across government and commercial organizations for well over a decade, Deloitte recently articulated four specific principles that are important to achieve broader, stronger and more convenient online transactions:

  • Digital identity solutions should be user-controlled and portable. This means citizens and consumers can easily access many online services with the same secure digital identity and not have to create multiple different ones for each service.
  • Digital identity services should be flexible and adaptive. Services should support the rapid integration of different end-user devices and authentication mechanisms – such as biometric technologies and low-friction solutions like behavioural analytics – based on evolving technologies and the shifting threat environment.
  • A broader digital identity ecosystem will likely emerge where verified information is consumed. For example, a citizen may establish reputational trust around their digital identity that can then be used to post online information or receive threat alerts, such as compromised email addresses or other information that may be shared among organizations in the ecosystem.
  • Strong digital identity systems should enable bi-directional trust. That is, governments need to know that authorized citizens are accessing services and information. But citizens also need to trust that they are interacting with a legitimate service, that their personal information will be protected, and that they can efficiently access services.

As noted, trust should extend throughout the full range of identity and service providers in the identity ecosystem. Although federation tools exist that help with technical interoperability (i.e. does the format of the data make sense?), there still remains a gap in defining “rules of the road” that can quantify the trust embodied in an identity credential: That is, are we really sure that the person presenting the credential is who they claim to be?

With respect to incentives, there is the potential for data-sharing among participants within a digital identity ecosystem. Such data could include shared threat signals, information on new vulnerabilities, profiles of emerging threat actors and broad information that helps unlock identity ecosystem-wide security capabilities in support of trusted transactions. This would allow governments and commercial organizations to deploy a layered approach that dynamically adjusts security controls based on the current known situational and transactional risk. It would also enable all participants of the broader digital identity ecosystem to have more confidence in the data that they rely upon and therefore encourage a richer set of participants.

Discover

What is the World Economic Forum doing about digital identity?

With the pandemic forcing greater online interaction, it is likely that a more virtual society will persist beyond the crisis. As such, a dynamic and cohesive digital identity ecosystem will be needed to enable citizens and consumers to more efficiently and conveniently navigate online, while governments and commercial organizations gain the assurance that they need to determine that benefits and services are going to the correct individuals. This virtual society will have many diverse circumstances – with use cases spanning a wide range of requirements for digital identities. But it is critical to achieve the right degree of trust and incentive that will instill the user confidence needed to drive economic growth for years to come.

Don't miss any update on this topic

Create a free account and access your personalized content collection with our latest publications and analyses.

Sign up for free

License and Republishing

World Economic Forum articles may be republished in accordance with the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Public License, and in accordance with our Terms of Use.

The views expressed in this article are those of the author alone and not the World Economic Forum.

Stay up to date:

Digital Identity

Related topics:
CybersecurityFourth Industrial Revolution
Share:
The Big Picture
Explore and monitor how Digital Identity is affecting economies, industries and global issues
A hand holding a looking glass by a lake
Crowdsource Innovation
Get involved with our crowdsourced digital platform to deliver impact at scale
World Economic Forum logo
Global Agenda

The Agenda Weekly

A weekly update of the most important issues driving the global agenda

Subscribe today

You can unsubscribe at any time using the link in our emails. For more details, review our privacy policy.

1:56

This AI granny is taking on phone scammers

Collaboration is key to tackling cybercrime. Recent takedowns show why

About us

Engage with us

  • Sign in
  • Partner with us
  • Become a member
  • Sign up for our press releases
  • Subscribe to our newsletters
  • Contact us

Quick links

Language editions

Privacy Policy & Terms of Service

Sitemap

© 2024 World Economic Forum