Identity authentication is absolutely necessary to conducting our affairs today. Without it, we would lose virtually all confidence to conduct business or create and foster relationships. But with ever increasing concerns related to data privacy, it is worth looking at the past to see what future challenges we may face in the digital identity space.

From Jewelry and Markings to Biometrics and AI

Unsurprisingly, identity authentication has gone from a slow evolution to a fast revolution. In ancient times, identity was usually authenticated by jewelry and markings, such as tattoos. These items verified familial ties, tribes, wealth and status within society. With the advent of writing, records could be kept and archived. Even those early records evolved and took different forms over time, standardizing themselves to include basic information, such as birth records, land title deeds and, in some cases, even citizenship.

Many of today’s identity-related documents have roots in the U.K. and other parts of Europe. For example, in 1414, King Henry V of England began to issue “Safe Conducts” documents, warning other countries to allow the bearers of these documents to travel freely. King Louis XIV of France granted travelers a document that allowed them to pass through a port freely, called a “passe port.” Now you know the origin of the word if you did not already.

It was not until the 19th and 20th centuries, however, that authentication really started to go into hyper drive. For thousands of years, we had physical items, markings and letters from a sovereign. Yet in a matter of 200 years, we came up with the following:

  • Personally identifiable information (PII) linked to a unique number, something first seen in British policing reforms
  • The photographic system, which would eventually integrate itself into forms of ID
  • National ID numbers, first seen in the Netherlands
  • Fingerprints used for precision identification
  • Commercial two-factor authentication (2FA) — i.e., a bank card and PIN
  • Smart cards
  • Sophisticated biometrics, such as retina scans, facial and voice recognition, body movement detection and even heart rate verification
  • Artificial intelligence (AI) and machine learning

The Ongoing Challenge of Information Collection

In a nutshell, for thousands of years, the problem could have been summed up like this: The means to collect the necessary information to accurately authenticate identity did not exist. Recent developments in digital identity technologies have turned the problem upside-down: The means to collect the necessary information to accurately authenticate identity not only exist, but are pervasive and ubiquitous.

Therein lies the data privacy problem: At what point does holding personal or digital identity data shift from being an asset to a liability? To answer the question, the problem cannot be viewed in a vacuum for a variety of reasons, including:

  • Local laws and guidelines;
  • Corporate policies;
  • End user licensing agreements;
  • Terms and conditions for product use;
  • Global travel and trade, including jurisdictional authority;
  • Where the data actually resides and which jurisdiction’s rules apply;
  • Who owns the data, the individual or the information gatherer;
  • What are “reasonable” levels of privacy, both in public and private spaces; and
  • Expectations of users and handlers.

Based on the list of issues, the future challenges of digital identity will have little to do with technology. They will, in fact, be almost exclusively related to policy — and policy-related challenges are the hardest to answer, as they are often matters of opinion.

Even when policies are agreed to, they are hard to implement because they take time, may be hard to enforce and, perhaps most importantly, represent a sign of change that could bring about resistance. Any IT professional who has tried to deploy on new production or shift platforms knows all too well what that resistance looks like.

Is Easier in the Short Term Better for the Long Term?

Technological means to establish digital identity assurance certainly exist. You can provide continuous identity monitoring, use AI and machine learning, and take advantage of the scalable and agile solutions the cloud offers. All of these tools help improve user and customer experiences, but we are still dealing with an environment full of fraudsters and tricksters whose sole purpose is to circumvent any technological defenses in place.

So what is the short-term solution?

Because this is an issue that cannot conceivably be solved overnight, the immediate step to protect digital identity is checking up on your cyber hygiene. No, this won’t solve the long-term digital identity and authentication problems, but you want to deal with what you can today by nipping your existing issues in the bud.

Next, ensure your cyber resilience is up to snuff, which, by definition, is dynamic and needs a watchful eye every day. What you did yesterday will not necessarily be good enough today, and will almost certainly not be good enough for tomorrow.

Finally, begin to think about not only how you want to handle your risk today, but also how you think you may want to handle tomorrow based on current trends and the list of issues outlined above. Data privacy is a risk all organizations face today. Remember your risk choices:

  • Risk acceptance
  • Risk transfer
  • Risk avoidance
  • Risk mitigation
  • Risk deferral
  • Risk exploitation

The issue of data privacy is unavoidable because more and more people have realized that they have been impacted by some sort of breach. It is always difficult to get an exact pulse on what public sentiment is, but it is not unreasonable to suggest that an increasing number of people are beginning to care about their digital identity, and are increasingly fed up with what is going on.

Therefore, keep in mind that in the digital identity space, as technological innovation allows identity authentication to go in one direction, for a set of reasons that are not technically related, data privacy may be going in another. That means that protecting digital identity will increasingly become the means to protect your organization. And if digital identities cannot be reasonably protected, the related privacy concerns will alter how business and relationships are handled. The only question left unanswered, then, is how?

More from Identity & Access

How to Keep Your Secrets Safe: A Password Primer

There are two kinds of companies in the world: those that have been breached by criminals, and those that have been breached and don't know it yet. Criminals are relentless. Today’s cyberattacks have evolved into high-level espionage perpetrated by robust criminal organizations or nation-states. In the era of software as a service (SaaS), enterprise data is more likely to be stored on the cloud rather than on prem. Using sophisticated cloud scanning software, criminals can breach an enterprise system within…

Making the Leap: The Risks and Benefits of Passwordless Authentication

The password isn't going anywhere. Passwordless authentication is gaining momentum, though. It appears to be winning the battle of how companies are choosing to log in. Like it or not, the security industry must contend with both in the future.  But for some businesses and agencies, going passwordless is the clear strategy. Microsoft, for instance, has recently stopped forcing users to use a password to access their account, which allows access to a wide range of Microsoft business and personal…

Old Habits Die Hard: New Report Finds Businesses Still Introducing Security Risk into Cloud Environments

While cloud computing and its many forms (private, public, hybrid cloud or multi-cloud environments) have become ubiquitous with innovation and growth over the past decade, cybercriminals have closely watched the migration and introduced innovations of their own to exploit the platforms. Most of these exploits are based on poor configurations and human error. New IBM Security X-Force data reveals that many cloud-adopting businesses are falling behind on basic security best practices, introducing more risk to their organizations. Shedding light on…

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users' perception of the…