Secure identity and electronic signatures essential for digital trust

Transcription

1 Secure identity and electronic signatures essential for digital trust Betalingsformidlingskonferansen, November 16 th 2017 Eirik Dalen, Signicat

2 Signicat's vision is to be the preferred provider of identity services to regulated industries across the world

3 Established 2007 #Customers >340 #Employees 82 Revenue 135MNOK Prognosis 2017 Y2Y growth 39% SLA Up to 99.9% Certification ISO27001 #Transactions >100M/year Presence Norway Sweden Denmark Finland The Netherlands Portugal UK Germany Planned

4 Signicat s reputation Winner of Innovation Award in Smart Security Week 2017 France Nominated for the European Fintech Award 2017 The Netherlands Winner of the Norwegian Fintech Achievement Award 2017 Norway Nominated for European Fintech Award 2016 The Netherlands Winner of the Future Payments 2013 and Cards & Payments Europe Best innovation award UK Winner of the International Identity Deployment of the Year Awards Las Vegas Winner of the Security Award, IT-sikkerhetsprisen Norway 4

5 Some background

6 Internet is growing FASTER!! Approximately 4 billion users ehealth Internet of Things Emerging markets Increasing exponentially Smart homes Self-driving cars Only 51% of world population coverage 6

7 Some curiosities If Facebook were a country, it would be the third largest in population after China and India Twitter is currently seeing about 50 million tweets PR DAY (or about 600 tweets per second) Years to reach a market audience of 50 million: Radio, 38 TV, 13 Internet, 4 Apple ipod, 3 Facebook, 2.. 7

8 Why is (digital) trust so important? Well, isn t trust in general important to all of us? Whether it s a computer, human or business relation The direct physical human-to-human trust aspect is watered out We rarely go into a bank branch anymore We rarely go into a public office anymore We do our shopping online with computers Digital or not; we need trust to do our errands with other parties Secure channels Knowledge of identity is essential. Person, organization or business. Knowledge of confidentiality for the information we share 8

9 A (simple) visualization of trusting a computer on behalf of a trusted company 9

10 Another example 10

11 Some technological elements to establish digital trust Certificates issued from trusted third parties knows as CAs You can t issue your own driver license Dedicated SSL/TLS certificates to establish trust between parties Security enabled communication protocols (encrypted) HTTPS, SSL/TLS, IPSec, etc.. Security enabled communication lines VPN, dedicated lines 11

12 Digital- identity (eid) and signature (esignature) Why? Attractive services Compliance Identify and authenticate Security User experience Who? Everyone operative in the digitalized world What? Various strength and formats of eids and esignature

13 Identity will be the most valuable commodity for citizens in the future, and it will exist primarily online. Eric Schmidt, Executive Chairman Google CRASSH 2013, University of Cambridge 13

14 14

15 At the eidas stakeholder event, Signicat was invited to present eid from the Nordic perspective, and explain how we help international companies work cross-border 15

16 Det tilsvarer i underkant av én tredjedel av oljefondet! 16

17 It s getting expensive not to comply with regulations 72M fine for a large UK-based bank Total fines since 2009 estimated to 500M in the UK 500M fine for a large Germany-based bank 3.3M fine for an Ireland-based bank 5.6M for Scotland-based bank group Many other examples New EU GDPR (General Data Protection Regulation) sets fine «limits» to 20M or 4% of global turnover May

18 In a digitalized world, user friendly and secure eids are essential for online regulated businesses. 18

19 19

20 So what is an eid, and do you have one? 20

21 Recognise these virtual eids? 21

22 Virtual eids are useful don t need another username and password 22

23 "I suppose it is tempting, if the only tool you have is a hammer to treat everything as if it were a nail. - Abraham Maslow, 1966

24 Recognize these? 24

25 25

26 26

27 27

28 28

29 29

30 Digital identity is online identification! Essential: - Regulatives and directives national and global: - GDPR - PSD2 - AML4 - Processes and quality insurance - Infrastructure - Required and user friendly services - Compliant with industry standards - ETSI - W3C - ISO

31 Consumers Service providers Bank Insurance Government Etc Compliance PSD2 AMLD4 eidas GDPR Signicat Digital Identity Service Provider (DISP) MobileID PSD2/SCA Fingerprint Identity assurance Authentication Electronic signatures/seals Docs & IDs Timestamping Cloud 99.9% availability Consumer identities eid providers Lookup services Hosted in Europe Public registers (address) Procuration Credit PEP Sanctions Cross border value-added services

32 32

33 Why electronic signatures? Advantages Reduce the turn-around time for a contract Avoid manual steps and paper Simpler for the user Simpler for the organization Reduce cost More business faster Better security Signed by Signicat 33

34 A signature should Intent Indicate signers approval Do so in a reliable way Identify the signer(s) Evidence Identification 34

35 Digital Signature level one Any means of replacing a handwritten signature with a digital one reply SMS reply Sign on paper, scan and «Scribble» on screen «I accept the offer» 35

36 Digital signature level two Uses cryptography User is identified Guarantees Authentication Integrity Non-repudiation Sign 36

37 Digital seal Digital signature added by an organization No human interaction Guarantees Authentication Integrity Non-repudiation Seal 37

38 Forgeries detected by Adobe Acrobat Invalid originator Modified document Organization identifier 38

39 The long term validation challenge The need to verify the signature in 5, 50 or 500 years

40 Regulations and directives AMLD4, PSD2, eidas, GDPR

41 What is AMLD4? EU directive 2015/849 4th Anti-Money Laundering Directive Entered into force Applicable as of

42 AMLD4 Customer Due Diligence (CDD) Identification and verification Reliable sources Documents Information Data Purpose and nature of business No specifics given Periodically 42

43 Cost Getting the balance right Regulatory compliance Abandonment rates 43

44 What is PSD2? EU directive 2015/2366 Payment services in the internal market Entered into force Applicable as of

45 What does this mean for identity? Strong Customer Authentication (SCA) Increased requirements for strong authentication Based on two factors Something you: know, have, is And remember SMS is «broken»... Applies to any payment transaction with both legs in the EU/EEA Finextra

46 PSD2 and identity data? Will the AIS and PIS expose identity data? A couple of indications from PSD2 Don t expose personal data if not needed PSD Article 67e: not request sensitive payment data linked to the payment accounts GDPR Regulation (EU) 2016/679 PSD2: Item 94 When developing regulatory technical standards on authentication and communication, EBA should systematically assess and take into account the privacy dimension, in order to identify the risks associated with each of the technical options available and the remedies that could be put in place to minimise threats to data protection. 46

47 What is eidas? (electronic IDentification, Authentication and trust Services) Part of the «Digital Agenda» program by the European Commission To boost TRUST and CONVENIENCE in secure and seamless cross-border electronic transactions by promoting the widespread use and uptake of electronic identification and trust services (eidas services). eidas is a regulation Which means that it is mandatory for the member states 47

48 eid and ets eid Electronic Identification ets Electronic Trust Services Key enablers for secure cross-border electronic transactions and central building blocks of the Digital Single Market 48

49 GDPR (General Data Protection Regulation) Strengthen and unify data protection for all individuals in the EU (EØS) Explicit consent from users to share information (a click is not sufficient) Strict requirements to keep evidence that the user has consented More than heavy fines for breaches ( 20M or 4% of global turnover) Strict routines for reporting Applicable May 1 st

50 Thank you so much for your time! And questions are most welcome