Mobile Identity and Authentication: How the Ecosystem is Evolving

Created: Wednesday, May 11, 2022, posted by Geetesh Bajaj at 10:00 am



1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

By Dario Betti, CEO, Mobile Ecosystem Forum

The wave of digital transformation triggered by the pandemic has changed many organizations quickly: from governments to restaurants, enterprises are now getting digitally ready. That is good news given the creation of additional customer value, and the newfound efficiencies that the digital world brings. However, there are some important considerations to be made.

One of the biggest weaknesses in terms of cybersecurity and the long-term sustainability of the digital economy is the issue of identity. Nobody really knows who you are on the Internet. Digital identity has been an afterthought. But things are changing, and fast. This is an area that needs to be understood much better.

Mobile Identity and Authentication
Image: Jump Story

Let’s clarify what is meant by personal data. Here is our short cheat sheet:

Identification: the process of identifying an individual

Authentication: the methods used to re-identify and validate individual identities either by what they have (eg SIM, phone, cookie), what they know (eg password or pin) or who they are (eg biometrics)

Verification: the steps taken to corroborate information provided by the individual by accessing trusted data sources and services (eg data brokers, aggregators, telcos)

Consumer Trust Issues

The security of their personal data and identity is now a major concern for consumers. Each year, the Mobile Ecosystem Forum (MEF) surveys the level of trust in the ecosystem, and 2021 data revealed a clear gap between the level of expectations from consumers versus real experience. The gap between mobile apps and services keeping data secure (versus the expectation) is 27 percentage points; the gap for privacy is 28 percentage points. This size of gap usually indicates a breaking point in the level of trust between users and a product. In short, the situation looks serious.

After scandals such as phishing or account take-overs, consumers are worried. From the 2021 MEF Survey, the top user concerns are:

  • Being defrauded / losing money – 49%
  • Cybercriminals gaining access to my data – 49%
  • Someone gaining access to my mobile – 47%
  • My online activity being monitored – 43%
  • Losing data from my device – 41%
  • Companies sharing or selling my data – 39%
  • Spam / junk email – 37%
  • Companies experiencing a data breach – 33%

Interestingly, None of the above scores just 6%.

Concerns over Personal Data Security and Privacy is now a reason to delete an app (37%), avoid installing one (33%), or stop using a service altogether (29%). The level of authentication/security is an element with a clear impact on consumer preferences.

Online Threats

In 2015, global fraud amounted to $3trillion dollars. By 2025, the figure will be $10.5trillion from fraud and cybercrime. The implication is that identity and access management to enterprise systems is becoming increasingly critical.

Globally, we are seeing a pronounced move towards an increasing reliance on digital identity and a clear move away from a distinctly unexceptional user experience and inadequate underlying security. The industry is having to develop new solutions that:

  1. meet the evolving needs of the user experience, and
  2. work to mitigate the threats.

Any solution must ensure that it is attractive to a broad range of people and does not discriminate. We need to be conscious of any regulatory developments or industry solutions that might result in digital exclusion by only focusing on solutions for certain groups of individuals – whether age, social status, digital sophistication, or age of their device. We need to be sure certain groups—for example, those with disabilities, or those with infrequent or difficult online access—are not excluded.

Online threats are becoming more intense, as is the inevitable fraud that drives these threats. Globally, 59% of enterprises surveyed in 2021 by MEF cited security and fraud prevention as the key driver for digital identity and authentication. The solutions becoming available seek to tackle some of the major issues we are currently seeing:

  • Device compromization – where a hostile party can take control of a device remotely
  • Smishing – when fraudsters attempt to elicit sensitive personal data, passwords, or banking details through SMS (the most common ways to authenticate globally)
  • SIM (Subscriber Identity Modules) swapping: where a mobile phone identity is swapped with the intention of taking over an account in order to impersonate the user (e.g. making calls, receiving authorization codes etc.)

Models for Personal Data and Identity

So, what are the models for personal data and identity? This is a critical question to ask. We need to analyze the ‘architecture’ of personal data/identity. The difference among these models implies different applications and threats. We can identify three architectures that are developing and succeeding across the globe that link the individual’s attributes to databases. Interestingly, biometrics is the common thread across all these architectures:

Centralized model – often operated by a government or consortium of financial institutions. In this model, an individual’s information is handled on a centralized database from cradle to grave and has the effect of offering a simplified means of establishing a digital identity for a range of services. An example of this approach is Singapore’s SingPass.

Federated model – operating with a series of distributed databases that represent different groupings and where parties can access personal data in one of those databases. The European eIDAS system is an example of one federated approach where trusted service providers can issue and deliver digital signatures and identities. Countries adopting this model include Belgium, the Netherlands, and Italy

Self-sovereign identity model – which has no centralized database where the individual owns, manages, controls, and issues their personal data.

Each of these models needs to ensure that the digital identity provided by a trusted service provider has strong authentication. In practice, we are starting to see the emergence of a new model based on these three models. This could be considered the establishment of digital credentials. An example of this would be an individual’s Covid status. This would allow a person to obtain their signed and verified health credentials which would then be trusted for access to venues or travel.

Clearly, there are issues around maintaining an individual’s privacy and how authentication fits into the process. Standards are developing that can provide further reassurance. Furthermore, there is the issue of regulation, how liability is distributed in this model of verifiable credentials, and how data is controlled and handled under regulatory requirements such as GDPR.

A Look at The Future

The ecosystem is fighting back from the threats of cyberattacks and we will see more of these innovative solutions emerge. There might not be an overall winner, but the co-existence of alternative approaches is now expected. Expect variety.

The good news is that the effort required to maintain security and reduce fraud will be significantly lessened by these technologies. This is because they will replace or enhance inadequate access control and authentication. Organizations and governments need this enhanced measure of multi-factor authentication to progress in the coming years. And individuals need the knowledge that their data is safe and that they can exercise trust in its integrity.

The global economy needs solutions to the developing issues that personal identity and authentication present. There are three major pillars to these solutions:

  • the role of the individual
  • establishing trust with organizations
  • handling the online experience.

To review or define an internal solution we should cover these three essential points. Covid has had a major impact on the way we live our lives and the ability to conduct in-person transactions has been transformed. Individuals are forced to navigate a remote and brutal online environment whilst establishing their identity. They are subject to ransomware and continual threats. This transformation is fast-paced and is requiring a strong degree of trust in sharing personal data with organizations and authorities. Clearly, there are inherent risks with online interactions and the sharing of personal data and the traditional ways of handling these are no longer fit for purpose.


Dario Betti
    
Dario Betti is CEO of MEF (Mobile Ecosystem Forum), a global trade body established in 2000 and headquartered in the UK with members across the world. As the voice of the mobile ecosystem, it focuses on cross-industry best practices, anti-fraud, and monetization. The Forum provides its members with global and cross-sector platforms for networking, collaboration, and advancing industry solutions.

The views and opinions expressed in this blog post or content are those of the authors or the interviewees and do not necessarily reflect the official policy or position of any other agency, organization, employer, or company.


Related Posts


Filed Under: Guest Post
Tagged as: , ,

No Comments

Leave a Reply

Your email address will not be published.

Microsoft and the Office logo are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries.

Plagiarism will be detected by Copyscape

© 2000-2022, Geetesh Bajaj - All rights reserved.