Do you remember the Internet of the good old days?
The internet as we know from the days of the dial-up connection let individuals gain access to information freely without any restrictions. The online world was built on the foundation of free and accessible information to all. One defining characteristic of this new invention was its ability to allow people to remain anonymous while communicating and transacting online. However, this anonymity has had a significant impact on the development and growth of services, especially in the financial sector.
In the early days of the internet, as instant messaging and email started to grow, we had to create online personas of ourselves using usernames and passwords. This information was often stored and managed by the internet platform, without giving users control over the uses and access to this sensitive data. This, in turn, resulted in massive breadcrumbs of personal information scattered across the internet, with no effective protocol or economy for managing and protecting this data.
Fast forward to today, more than 40 years after dial-up internet was first introduced, there hasn’t been much change in the amount of scattered identity information across the internet. We have definitely seen some improvements, but internet users today still rely on a fragmented identity infrastructure that uses usernames and passwords.
However, over time, there has been a shift towards recognising the importance of user ownership of their data. Internet users today are becoming more aware of their right to control their online identity and protect their privacy. This has led to the development of new technologies and frameworks that enable users to manage their online identities in a more decentralised and secure manner.
These slow and steady changes can be classified into three areas:
- Ownership
- Centralisation
- Verification/Authentication
Who owns your data?
Government agencies and enterprises today still collect and store vast amounts of citizen and user data in their infrastructures. Though it seems like the sensible thing to do, this collection of large amounts of data raises various challenges. Businesses have historically treated this data as their own property, often using it for purposes other than those intended. This has in turn led to numerous challenges surrounding the privacy and rights of individuals whose data is being collected. This has also unfortunately resulted in data breaches, identity theft, and other violations of privacy.
However, there has been growing recognition among organisations, not out of self-policing, but due to the advent of data privacy regulations and increasing cost of data breaches, to respect user privacy and give them control over their personal data. This has led to the development of privacy-preserving technologies that enable users to manage and control their online identities without the need for intermediaries. This has encouraged a shift in mindset that has enabled the adoption of better practices in data management and privacy, including:
- Compliance: Organisations are now adhering to more stringent data protection regulations, such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. These regulations mandate organisations to obtain explicit consent from users before collecting and using their data, and to provide clear information about how their data will be used. They also require organizations to implement strong security measures to protect user data and to notify users in the event of a data breach.
- Transparency: Regulations are also pushing organisations to become more transparent about their data collection and management practices. Companies are now required to provide users with clear and concise information about their data practices, including what data is being collected, how it is being used, and who it is being shared with. This transparency helps users make more informed decisions about how their data is being used and whether they want to share it with a particular organisation.
- User Control: One of the key principles of data privacy is giving users control over their own data. Many organizations are now implementing tools and features that allow users to access, edit, and delete their data as they see fit. For example, users can now adjust their privacy settings on social media platforms to control who can see their posts and personal information. Users can also opt out of certain data collection practices, such as targeted advertising.
- Privacy by Design: Privacy by design is a principle that requires organisations to consider privacy implications at every stage of a product or service’s development rather than as an afterthought. This means that organisations are now building privacy into their products and services from the ground up, rather than trying to retrofit privacy protections at a later stage. This approach helps organisations avoid potential privacy issues and ensures that privacy is considered a core component of their products and services.
Why shouldn’t your data be stored in a single place?
Centralised systems are ones where user data is stored and managed by a single entity or a few centralised entities, generally governments and enterprises. Centralisation has been the norm on the internet for a long time, with large corporations and governments controlling most of the data that is generated online.
These centralised systems have numerous drawbacks. They are often vulnerable to data breaches, as the centralised entity becomes a target for hackers looking to steal sensitive user data. Centralised systems also give the entity in control too much power over user data, creating privacy and security concerns.
In addition to the challenges associated with centralised data on the Internet, there are also issues surrounding centralised data in specific industries, such as banking and telecommunications. These industries collect and store vast amounts of sensitive user data, ranging from financial information to personal data. This data is typically stored in centralised repositories, making it vulnerable to cyber-attacks and security breaches.
Furthermore, the rise of mobile devices and applications has resulted in an increase in centralised data repositories. Many apps on our phones collect and store personal data, including location data, contact lists, and browsing history, in centralised repositories. This is very concerning, as users often have little control over how this data is used and who has access to it.
However, there has been a slow but steady shift towards decentralisation in these industries, driven in part by GDPR and CCPA regulations. In response to these regulations, many organisations are exploring decentralised approaches to data management. For example, some banks are exploring the use of blockchain technology to securely and transparently manage financial transactions and identity data. Similarly, some telecommunications companies are exploring the use of decentralised networks to improve the security and reliability of their services.
While the shift towards decentralisation in these industries is slow, it is a positive trend towards more secure and privacy-focused data management practices. As regulations continue to evolve and consumers become more aware of their rights to control their data, we can expect to see more innovative solutions emerge in these industries.
How are biometrics and SSI changing the IDV ecosystem?
Identity verification and authentication are essential components of securing critical data. In the past, verification and authentication relied heavily on centralised systems such as usernames and passwords. However, these systems are vulnerable to hacking and data breaches, making them an unreliable means of protecting sensitive data.
To address this issue, there has been a growing focus on developing more secure and decentralised approaches to verification and authentication. One such approach is the use of biometric data, such as fingerprints or facial recognition, to authenticate users. Biometric data is unique to each individual, making it a more secure means of verification than passwords or usernames.
Along with this, there has also been a growing interest in self-sovereign identity (SSI) systems, which allow users to own and control their identity information. SSI systems are based on decentralised technologies such as blockchain, which enables users to manage their identity information and share it securely with other parties without relying on a centralised authority.
Where does identity sit in an organisation?
In today’s digital age, identity management is an essential concern for organisations worldwide. As companies continue to migrate their services to the digital realm, they must take steps to secure sensitive information and prevent unauthorised access. While every department in an organisation has a role to play in managing identity, no single department is solely responsible for it.
Let’s take a deeper look at how different departments in an organisation manoeuvre around identity.
- Infosec: The information security department plays an important role in protecting a company’s data and preventing unauthorised access to it. They work closely with the IT department to implement and maintain secure identity management systems. They also have to ensure that the organisation’s identity management practices comply with relevant security standards and perform regular risk assessments. The infosec department must also ensure that employees are trained in secure identity management practices and are aware of the potential risks associated with identity theft and data breaches.
- IT: The IT department is responsible for implementing and maintaining identity management systems to ensure that user data is securely stored and protected from unauthorised access. They also ensure that a company’s technology infrastructure is updated and secure.
- Product: The product team ensure that identity management practices do not hinder the user experience. They must develop products that seamlessly integrate with identity management systems and make it easy for users to verify their identity when necessary.
- Operations: The operations department must ensure that identity management practices are integrated into the organisation’s overall security strategy. They must also ensure that any changes to identity management systems are tested thoroughly and deployed effectively.
- Finance: The finance department is responsible for managing and processing financial transactions. They must ensure that identity verification is implemented correctly to prevent fraudulent transactions and protect the organisation’s financial assets.
- UX: The UX department is responsible for designing user interfaces and experiences that are intuitive and easy to use. When it comes to identity management, the UX team must ensure that the verification process is seamless and does not create unnecessary friction for the user. They must also design interfaces that make it easy for users to manage their identity data and privacy settings.
- Marketing: The marketing department is responsible for promoting the organisation’s products and services to customers. They must ensure that their messaging aligns with the organisation’s identity management practices and that customers are aware of how their data is being used and protected. They must also be transparent about any data breaches or security incidents that occur.
- Compliance: The compliance department is responsible for ensuring that the organisation complies with relevant laws and regulations, such as the GDPR, CCPA, or HIPAA. They must ensure that the organisation’s identity management practices are in line with these regulations and that any data breaches or security incidents are reported to the appropriate authorities.
Identity verification of the future
The method of managing online identities has evolved significantly over the past few decades. The internet has grown from a simple platform that allowed users to access information freely to a complex system that requires robust and secure identity management solutions.
Today, there is a growing recognition among organisations and users of the importance of user control over personal data, the risks associated with the centralisation of data, and the need for secure and reliable identity verification and authentication. This has led to the development of new technologies and frameworks that enable users to manage their online identities in a more decentralised and secure manner.
However, there is still a long way to go in terms of creating a robust and secure online identity management system. As new threats and challenges emerge, it is essential to develop comprehensive identity ecosystems to keep up with the evolving landscape of the internet.
