Let's Talk About Digital Identity

In episode 22, Oscar talks to Susana about what biometrics enable that other identifiers can’t; the importance of anti-spoofing (liveness); privacy concerns around biometrics and regulatory impact; algorithmic bias in biometrics (including racial, age, gender and other demographic differentials) and Onfido's work with the ICO in this regard.

"Biometrics protect users against themselves in situations where they might not realise they're under attack"

Susana has a varied background in product management in the B2B space. She has a breadth of platform experience, from web front and backend, iOS, Android and Machine learning infrastructure. Her current role is director of product at Onfido, specifically focusing on their biometric product offering.

Connect with Susana on Twitter @susanavlopes and on LinkedIn.

Onfido is building the new identity standard for the internet. Its AI-based technology assesses whether a user’s government-issued ID is genuine or fraudulent, and then compares it against their facial biometrics. Its mission is to create a more open world, where identity is the key to access.

For more information, visit: onfido.com or follow Onfido on social media: Facebook, Twitter @Onfido and LinkedIn. As referenced in the episode, you can also find Onfido's tech blog on Medium here: https://medium.com/onfido-tech.

Onfido is a Ubisecure partner. Find out more about the partnership here - www.ubisecure.com/news-events/onfido-partnership/.

Susana also refers to a NIST study on demographic differentials of biometric facial recognition accuracy, which can be found here: https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8280.pdf

We’ll be continuing this conversation on LinkedIn and Twitter using #LTADI – join us @ubisecure!

In episode 22, we're featuring a bonus lockdown episode in which Oscar talks to Simon about how the current pandemic has changed, and is still changing, the digital identity landscape.

"Now is the time for the digital identity industry to practice what we preach - security, efficiency, user experience, regulatory compliance."

The conversation covers the key issues surrounding remote working and digital-first strategies, exploring both the commercial and governmental sides of the situation we all find ourselves in. Simon touches on the privacy aspects of contact tracing, the now 'blurred lines' of internal and external users from an identity and access management perspective, and the key role of SaaS to enable fast routes to digitalisation.

As Group CEO at Ubisecure, Simon Wood is responsible for planning, communicating and delivering Ubisecure’s overall vision and corporate strategy to enable the true potential of digital business through modern identity management solutions.

Connect with Simon on LinkedIn.

As mentioned in the episode, Simon joined a previous episode of Let's Talk About Digital Identity. Catch up here: https://www.ubisecure.com/podcast/simon-wood/.

Ubisecure provides feature rich customer identity management software and services to help companies reduce identity data breach risk, improve operational efficiencies, and improve user experience.

Find out more at ubisecure.com.

We’ll be continuing this conversation on LinkedIn and Twitter using #LTADI – join us @ubisecure!

"The most common system or platform to get hacked is the system you didn't even know you had"

We all know the importance of regulatory compliance in any Identity and Access Management (IAM) scenario. What we don't always know is how to make colleagues engage with compliance, to ensure they sit up, listen and remember to always keep compliance front of mind.

In episode 21, Bengt Berg fills us in on the new alternatives to the dreaded compliance management handbook that sits on the office shelf collecting dust, taking inspiration from the finance industry. Oscar and Berg also cover other key topics such as how to convince the board that IT security is important with easily accessible metrics, specific cases of IT security compliance in IAM and Cybercom's approach to compliance management.

Bengt has been in the IT security industry since 1994, when building encryption systems for people in uniforms, have been a manager in an American big firm, has taken some time in the finance industry and today works as a do-all guy at Cybercom. Some sales, some consulting, some business strategy, and is also a member of the steering group of Cybercom Secure. He is also the proud father and protector of Cybercom’s products and services in the Compliance Management area.

Connect with Bengt on LinkedIn or at [email protected].

Find out more about Cybercom at www.cybercom.com.

Enjoyed this episode? Listen to episode 10 with Bengt's colleague, Cybercom’s Head of IAM Solutions, Robin von Post.

We’ll be continuing this conversation on LinkedIn and Twitter using #LTADI – join us @ubisecure!

Why are APIs not just a technical issue, but a business issue as well? In episode 20, Oscar chats to API guru Marjukka Niinioja about the opportunites APIs can create, how COVID-19 has highlighted the need for digitalisation, the role of identity in API security and the importance of standards like OpenID Connect.

"You don't need to have an army of coders, you just need to buy the capabilities as APIs"

Marjukka Niinioja is co-author of API Economy 101 book and founding partner and leading consultant at Osaango, a company specialising in API and Platform economy. Osaango has worked with several companies in Finland and abroad as well as public organisations to help them not only learn about the possibilities of API and Platform business models but also define their API and platform strategies and guide them in the implementations.

For links and more information visit www.osaango.com

Marjukka is also the "mother" of the lean, business-oriented and open APIOps Cycles method, creator of the open course about API Economy with Tampere University and the local organiser of APIdays Finland conferences.

Visit APIOps Cycles at www.apiopscycles.com and check out the API Economy open course at Tampere University at www.osaango.academy/courses/intro-to-api-economy.

For a roundup of APIdays Finland 2019, read Oscar's blog - www.ubisecure.com/api/apidays-finland-2019/

Find Marjukka on Twitter @MNiinioja and on LinkedIn.

We’ll be continuing this conversation on LinkedIn and Twitter using #LTADI – join us @ubisecure!

In episode 19, Oscar talks to Sid about what exactly a decentralised ID is, its benefits, use cases and open standards such as the Decentralized Identifiers (DIDs) specification from W3C. They also discuss how DID will develop in the coming years, and why REMME is building a decentralised model of Public Key Infrastructure (PKI).

"Blockchain replaces traditional 'trust by authority' with 'trust by computation'."

Sid Desai is a Boston (USA) based IT security professional who’s passionate about user/machine identities, security & PKI. Sid has led the distributed identity front in his work at REMME, helping work with the platform, engineering and partner teams to massively extend the impact of decentralised identity & authentication solutions for the modern enterprise. He consults with REMME’s customers around the world on how to transform their identity & authentication ecosystems thus helping them increase their business integrity & efficiency while lowering costs. Recognised as a well-rounded advocate for identity, digital transformation and blockchain-enabled solutions, Sid is also a regular speaker, contributing author and media commentator. Find Sid on LinkedIn or email [email protected].

Founded in 2015, REMME is building the distributed Public Key Infrastructure protocol and PKI-enabled apps to address the challenges of Web 3.0. REMME Auth is a 2-click authentication solution that allows users to securely access a website without passwords. Instead, the solution uses X.509 self-signed certificates and blockchain technology. Find out more at remme.io.

REMME is a Ubisecure partner, with the companies collaborating to create identity solutions using blockchain technology. Read the press release here - https://www.ubisecure.com/news-events/remme-ubisecure-blockchain-identity-management/

We’ll be continuing this conversation on LinkedIn and Twitter using #LTADI – join us @ubisecure!

In episode 18 we're joined by Dean Coclin, representing the world's largest public Certificate Authority (CA) – DigiCert. The conversation explores exactly what a CA does and its critical role in Public Key Infrastructure (PKI).

Listen in on DigiCert's view of, and role in, digital identity with relation to Transport Layer Security (TLS) and Extended Validation (EV) certificates, the Internet of Things (IoT) and Legal Entity Identifiers (LEIs).

DigiCert announced a partnership with Ubisecure in December 2019, collaborating to extend the use of LEIs for multiple types of digital certificate-based use cases. Read the press release here - ubisecure.com/news-events/digicert-ubisecure-partnership-legal-entity-identifier-organization-identity-solutions.

Dean also fills us in on the CA/Browser Forum and the ASC X9 PKI Study Group, which he chairs.

"What good is encryption if we don't know who we are encrypting to?"

Dean Coclin brings more than 30 years of business development and product management experience in software, security and telecommunications. As Senior Director of Business Development at DigiCert, he is responsible for representing the company in industry consortia and driving the company's strategic alliances with technology partners. Mr. Coclin is also the past Chair of the CA/Browser Forum and the CA Security Council. Currently he chairs the ASC X9 PKI Study Group.

Previously Mr. Coclin worked at Symantec’s Website Security business unit before it was sold to DigiCert and was one of the founders of ChosenSecurity, an Internet security firm which was sold to PGP Corporation in February 2010. PGP was subsequently acquired by Symantec in June 2010. Prior to this, Mr. Coclin was Director of Business Development at GeoTrust which was sold to Verisign in 2006. He holds a BSEE and MS from The George Washington University and an MBA from Babson College.

Follow Dean on Twitter @chosensecurity and find his articles on the DigiCert blog at digicert.com/blog.

For more information on DigiCert, visit its website - digicert.com – and follow the CA/Browser Forum at cabforum.org.

We’ll be continuing this conversation on Twitter using #LTADI – join us @ubisecure!

"We need to think about identities before thinking about applications of digital technologies."

This week, Oscar chats to Grace Mutung'u about challenges for digital identity in Kenya and the various considerations for inclusive national identification, including historical, social and economic issues. She fills us in on the court case against Huduma Namba (Kenya's national ID platform) that she has been involved in and its recent judgement to rule out unnecessary DNA and GPS data collection, and the framework that must be in place before being fully rolled out.

Grace is a research fellow at the Centre for IP and IT Law (CIPIT) at Strathmore University, studying digital ID and society in Kenya. She has been involved in ICT policy advocacy for over 10 years and was most recently providing support during litigation in Kenya's digital ID case.

Find Grace on Twitter @bomu.

Find out more about the Centre for Intellectual Property and Information Technology Law (CIPIT) - a think tank and training centre established under Strathmore Law School at cipit.org.

We’ll be continuing this conversation on Twitter using #LTADI – join us @ubisecure!

In episode 16, Niklas fills us in on how mobile operators around the world have joined forces to build a standard for strong authentication and other services to help protect our digital identity – Mobile Connect.

"It may be that you and I, and some of the listeners of the podcast, are interested in identity. For the rest of the world its a necessary evil."

Niklas and Oscar discuss Mobile Connect (a mobile identity-based service), its proven global use cases (such as China Mobile), why digital identity became a strategic priority for GSMA and the unique insights of MNOs to improve digital identity.

Niklas Bergvall, Chair of the Mobile Connect Interest Group at GSMA, leads the international Mobile Connect community developing and commercialising new identity capabilities using Mobile Connect. The Mobile Connect community engages over 70 mobile operators in over 30 countries, countless service providers, reaching over half a billion people worldwide.

With over 20 years of experience in the mobile ecosystem, Niklas has an exceptional understanding of the key challenges being faced when launching products and services internationally. Prior to the GSMA, Niklas launched and managed a number of global business-to-business products and services in various roles at Vodafone, Oxford Instruments and Europolitan.

Find Niklas on LinkedIn.

Find out more about GSMA at www.gsma.com and Mobile Connect at www.gsma.com/identity/mobile-connect.

We’ll be continuing this conversation on Twitter using #LTADI – join us @ubisecure!

In episode 15, Oscar talks to Andy about Hitachi's pioneering finger-vein biometrics – VeinID Five. Hear about its use cases (present and future), the evolution of the product to its current form, comparison with other biometric and non-biometric authentication methods and, importantly, the relevant privacy and security risk mitigations.

Andy Milton is Head of Channels and Marketing for Hitachi Security Business Group. He joined Hitachi in November 2018 to lead and develop the channel strategy for the Hitachi Security Business Group in EMEA and North America. With over 30 years in IT and 20 years in cybersecurity, Andy's experience in working for both vendors and channel partners has given him a unique insight into the workings and drivers for aspects of the channel. He brings experience across a wide range of products and solutions including SIEM, device management, WAFs, network devices and a specific interest in identity management and biometrics.

Get in touch with Andy on LinkedIn.

Hitachi Europe Ltd., a wholly owned subsidiary of Hitachi, Ltd. (TSE: 6501, "Hitachi") is headquartered in Maidenhead, UK. The company is focused on its Social Innovation Business - delivering innovations that answer society’s challenges. Hitachi Europe and its subsidiary companies offer a broad range of information & telecommunication systems; rail systems, power and industrial systems; industrial components & equipment; automotive systems, digital media & consumer products and others with operations and research & development laboratories across EMEA. For more information, visit www.hitachi.eu.

To find out more about Hitachi's Finger Vein products visit digitalsecurity.hitachi.eu.

We’ll be continuing this conversation on Twitter using #LTADI – join us @ubisecure!

Episode 14 features a discussion by Oscar and Rainer about identity management and e-government, including views on challenges in real e-government projects - India's Aadhar, Austria's smart ID card and China's residents' card. They also talk about Kanatara's e-government workgroup, of which Rainer is the chair, and the annual TIIME conference, which he organises.

Rainer graduated in Computer Science from the University of Vienna. Working as a software developer for some years, he then specialised in identity and access management starting in 2001. In roles as a security and identity architect he contributed to projects like the Austrian eGovernment identity federation and European framework projects (epSOS, MAPPING). He is chair of the eGovernment WG at Kantara Initiative and contributor to standardisation activities in standards developing organisations like ISO SC27. He started the TIIME event – an annual identity conference - in 2013. Currently he has the position of Senior Manager at KPMG Austria, consulting clients in different sectors on enterprise IAM topics.

Find Rainer on Twitter @rhoerbe1 and on LinkedIn.

Find out more about the TIIME (Trust and Internet Identity Meeting Europe) event on 17-20 February in Vienna at tiimeworkshop.eu.

Check out Kantara's eGovernment Work Group here - kantarainitiative.org/confluence/display/eGov/Home.

We'll be continuing this conversation on Twitter using #LTADI - join us @ubisecure!