Identity authentication is absolutely necessary to conducting our affairs today. Without it, we would lose virtually all confidence to conduct business or create and foster relationships. But with ever increasing concerns related to data privacy, it is worth looking at the past to see what future challenges we may face in the digital identity space.

From Jewelry and Markings to Biometrics and AI

Unsurprisingly, identity authentication has gone from a slow evolution to a fast revolution. In ancient times, identity was usually authenticated by jewelry and markings, such as tattoos. These items verified familial ties, tribes, wealth and status within society. With the advent of writing, records could be kept and archived. Even those early records evolved and took different forms over time, standardizing themselves to include basic information, such as birth records, land title deeds and, in some cases, even citizenship.

Many of today’s identity-related documents have roots in the U.K. and other parts of Europe. For example, in 1414, King Henry V of England began to issue “Safe Conducts” documents, warning other countries to allow the bearers of these documents to travel freely. King Louis XIV of France granted travelers a document that allowed them to pass through a port freely, called a “passe port.” Now you know the origin of the word if you did not already.

It was not until the 19th and 20th centuries, however, that authentication really started to go into hyper drive. For thousands of years, we had physical items, markings and letters from a sovereign. Yet in a matter of 200 years, we came up with the following:

  • Personally identifiable information (PII) linked to a unique number, something first seen in British policing reforms
  • The photographic system, which would eventually integrate itself into forms of ID
  • National ID numbers, first seen in the Netherlands
  • Fingerprints used for precision identification
  • Commercial two-factor authentication (2FA) — i.e., a bank card and PIN
  • Smart cards
  • Sophisticated biometrics, such as retina scans, facial and voice recognition, body movement detection and even heart rate verification
  • Artificial intelligence (AI) and machine learning

The Ongoing Challenge of Information Collection

In a nutshell, for thousands of years, the problem could have been summed up like this: The means to collect the necessary information to accurately authenticate identity did not exist. Recent developments in digital identity technologies have turned the problem upside-down: The means to collect the necessary information to accurately authenticate identity not only exist, but are pervasive and ubiquitous.

Therein lies the data privacy problem: At what point does holding personal or digital identity data shift from being an asset to a liability? To answer the question, the problem cannot be viewed in a vacuum for a variety of reasons, including:

  • Local laws and guidelines;
  • Corporate policies;
  • End user licensing agreements;
  • Terms and conditions for product use;
  • Global travel and trade, including jurisdictional authority;
  • Where the data actually resides and which jurisdiction’s rules apply;
  • Who owns the data, the individual or the information gatherer;
  • What are “reasonable” levels of privacy, both in public and private spaces; and
  • Expectations of users and handlers.

Based on the list of issues, the future challenges of digital identity will have little to do with technology. They will, in fact, be almost exclusively related to policy — and policy-related challenges are the hardest to answer, as they are often matters of opinion.

Even when policies are agreed to, they are hard to implement because they take time, may be hard to enforce and, perhaps most importantly, represent a sign of change that could bring about resistance. Any IT professional who has tried to deploy on new production or shift platforms knows all too well what that resistance looks like.

Is Easier in the Short Term Better for the Long Term?

Technological means to establish digital identity assurance certainly exist. You can provide continuous identity monitoring, use AI and machine learning, and take advantage of the scalable and agile solutions the cloud offers. All of these tools help improve user and customer experiences, but we are still dealing with an environment full of fraudsters and tricksters whose sole purpose is to circumvent any technological defenses in place.

So what is the short-term solution?

Because this is an issue that cannot conceivably be solved overnight, the immediate step to protect digital identity is checking up on your cyber hygiene. No, this won’t solve the long-term digital identity and authentication problems, but you want to deal with what you can today by nipping your existing issues in the bud.

Next, ensure your cyber resilience is up to snuff, which, by definition, is dynamic and needs a watchful eye every day. What you did yesterday will not necessarily be good enough today, and will almost certainly not be good enough for tomorrow.

Finally, begin to think about not only how you want to handle your risk today, but also how you think you may want to handle tomorrow based on current trends and the list of issues outlined above. Data privacy is a risk all organizations face today. Remember your risk choices:

  • Risk acceptance
  • Risk transfer
  • Risk avoidance
  • Risk mitigation
  • Risk deferral
  • Risk exploitation

The issue of data privacy is unavoidable because more and more people have realized that they have been impacted by some sort of breach. It is always difficult to get an exact pulse on what public sentiment is, but it is not unreasonable to suggest that an increasing number of people are beginning to care about their digital identity, and are increasingly fed up with what is going on.

Therefore, keep in mind that in the digital identity space, as technological innovation allows identity authentication to go in one direction, for a set of reasons that are not technically related, data privacy may be going in another. That means that protecting digital identity will increasingly become the means to protect your organization. And if digital identities cannot be reasonably protected, the related privacy concerns will alter how business and relationships are handled. The only question left unanswered, then, is how?

More from Identity & Access

Cybersecurity in the Next-Generation Space Age, Pt. 3: Securing the New Space

View Part 1, Introduction to New Space, and Part 2, Cybersecurity Threats in New Space, in this series. As we see in the previous article of this series discussing the cybersecurity threats in the New Space, space technology is advancing at an unprecedented rate — with new technologies being launched into orbit at an increasingly rapid pace. The need to ensure the security and safety of these technologies has never been more pressing. So, let’s discover a range of measures…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

An IBM Hacker Breaks Down High-Profile Attacks

On September 19, 2022, an 18-year-old cyberattacker known as "teapotuberhacker" (aka TeaPot) allegedly breached the Slack messages of game developer Rockstar Games. Using this access, they pilfered over 90 videos of the upcoming Grand Theft Auto VI game. They then posted those videos on the fan website Gamers got an unsanctioned sneak peek of game footage, characters, plot points and other critical details. It was a game developer's worst nightmare. In addition, the malicious actor claimed responsibility for a…