Trust Elevation through Contextual Authentication Regional Arab Forum on Cybersecurity Giza (Smart Village)-Egypt, 18-2

1. Trust Elevation through Contextual Authentication Regional Arab Forum on CybersecurityGiza (Smart Village)-Egypt, 18-20 December 2011 Abbie Barbir, PhD ITU-T SG 17 Identity Management Rapporteur Abbie.Barbir@ties.itu.int Co-chair OASIS Trust Elevation TC http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=trust-el Elected Member of OASIS Board of Directors http://www.oasis-open.org/board

2. ITU-T Study groups (2009-2012) • ITU-T Objectives • Established 17 May 1865 • Decisions by consensus • Participation through national Government • Telecom does not mean that focus is only on Telecom • Develop and publish standards for global ICT interoperability • Identify areas for future standardization • Provide an effective forum for the development of international standards • Truly global public/private partnership • 95% of work is done by private sector • Continuously adapting to market needs • SG 3 • Tariff , accounting telecom economic & policy issues SG 11 Signalling requirements, protocols and test specifications • SG 2 • Service provisioning and Telecom management SG 5 Environment and climate change SG 9 Television, sound and integrated broadband cable networks SG 17 security, identity management (IdM) and languages SG 16 Multimedia coding, systems and applications SG 13 Future networks including mobile and NGN

3. SG 17 Q10/17 Identity management Interoperability of identity management X.giim, Generic IdM interoperability mechanisms X.1250, Baseline capabilities for enhanced global identity management trust and interoperability X. 1250 Baseline capabilities for enhanced global identity management trust and interoperability X. 1251 A framework for user control of digital identity   X. 1252 Baseline identity management terms and definitions   X.1253 (X.idmsg), Security guidelines for identity management systems Trust of identity management X.EVcert, Extended validation certificate X.eaa, Information technology – Security techniques – Entity authentication assurance X.atag, Attribute aggregation framework X.idmcc, Requirement of IdM in cloud computing X.mob-id, Baseline capabilities and mechanisms of identity management for mobile applications and environment X.oitf, Open identity trust framework Discovery of of identity management information X.discovery, Discovery of identity management information Protection of personally identifiable information X.1275, Guidelines on protection of personally identifiable information in the application of RFID technology X.priva, Criteria for assessing the level of protection for personally identifiable information in identity management Working with OASIS SAML 2.0 and XACML and their equivalent ITU-T recommendations

4. Q10/17 Coordination and collaboration ITU-T Joint coordination activity in IdM JCA-IdM

5. OASIS Trust Elevation TC • OASIS Electronic Identity Credential Trust Elevation Methods (Trust Elevation) TC • http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=trust-el • Works to define a set of standardized protocols that service providers may use to elevate the trust in an electronic identity credential presented to them for authentication • Respond to suggestions from the public sector, including the U.S. National Strategy for Trusted Identities in Cyberspace (NSTIC). • Promotes interoperability among multiple identity providers--and among multiple identity federations and frameworks--by facilitating clear communication about common and comparable operations to present, evaluate and apply identity [data/assertions] to sets of declared authorization levels

6. National Strategy for Trusted Identities in Cyberspace (NSTIC) • Called for in President’s Cyberspace Policy Review (May2009) • Promotes the development of an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities Usernames and passwords are broken • People have many different passwords • Password reused • Strong passwords vulnerable • Identity Theft on the rise • Large increase in financial institution Suspicious Activities • $17.3 billion estimated cost to economy over 2 years (BJS,2008) • Cybercrime is on the rise • Phishing is increasing with more sophisticated attacks Guiding Principles • Privacy Enhancing and Voluntary • Secure and Resilient • Interoperable • Cost Effective • Easy To Use Main issue • How to verify the Carbon entity on the other end of an online transactions • Identities are difficult to verify over the internet • Problem is more complicated in North America due to the lack of a government based national identity system

7. Entity Authentication Assurance • Entity Authentication Assurance Framework* • Joint work of ISO JTC1/SC 27/WG5 and ITU-T SG 17/Q.10 • Expected to reach Committee Draft status this year • Standardizes Levels of Assurance (LoAs) to promote trust, improve interoperability, and facilitate identity federation across organizations • ISO/IEC 29115 | ITU-T X.1254 provides a framework for managing entity authentication assurance in a given context. In particular, it: • specifies four levels of entity authentication assurance; • specifies criteria and guidelines for each of the four levels of entity authentication assurance; • provides guidance concerning controls that should be used to mitigate authentication threats; • provides guidance for mapping the four levels of assurance to other authentication assurance schemes; • provides guidance for exchanging the results of authentication that are based on the four levels of assurance.

8. Entity Authentication Assurance Why so the work? • Provides a consistent basis for trust • Promotes identity federation • Helps organizations make informed decisions • Enables credential re-use in different contexts • Promotes efficiency and reduces costs • Enables cross-organization and cross-border services • Provides framework for further standardization

9. Entity Authentication Assurance Structure and Contents • Four Levels of Assurance • Entity Authentication Assurance Framework • Management and Organizational Considerations • Threats Based on Framework Components • Required Controls for Each LoA • Privacy and Protection of PII • Operational Service Assurance Criteria

10. EAA Framework Application/ Initiation Proofing Verification Registration LoASelection RiskAssessment Rights,Access Controls,etc. Record-Keeping Authorization Binding Revocation scope boundary of this standard Enrollment Usage Authentication CredentialManagement Issuance 10

11. Authentication • Towards Digital Trust • FFIEC Supplement to Authentication in an Internet Banking Environment • Layered Security to eliminate Customer Authentication for High-Risk Transactions • Retail/Consumer and Business/Commercial Banking • Detect and Respond to Suspicious Activity • Device Identification • Challenge Questions (KBA) • False Sense of Security • Need to move away from it

12. More on Authentication How to define Authentication Strength ? • Simply counting authentication factors • Something • you know • you have • you are (or inherit ) • does not inform us about the strength of a given authentication method • Authentication methods can be based on a single authentication attribute or on any two or more attributes of different kinds • Many vendors and enterprises do not implement true two-factor authentication and do not have a consistent definition of the term. • Consider measuring a method strength to attacks, for example: • Masquerade attacks and man-in-the browser attack • Evaluate the strength of an authentication method to confirm that it meets the needs for assurance or authorizations request. Based on Gardner paper G00219391

13. Device Identifications From Smart Device perspectives • Cookies are increasingly becoming obsolete for device and user identification • IP address is not reliable Different Approaches are used • Identification in Browser based technologies (SAML, OpenID) is different from Native Application (Aouth2.0 and OpenID connect) Standards are needed • Need to move towards interoperable cookie-less device independent identification methods in order to prevent fraud in financial transactions • Support for cloud based interactions • Support for interoperable token based services • “one-time” cookies • Eventually  every device needs an immutable, provision-able, isolated  NVM to store its identity • Programmable RD/WR/OTP/ERASE capable • Scalable cross devices (power, form factor, standard) • Ultimately needs to have appropriate crypto support

14. Current Basic “Trust Triangle” • User has direct trust relationship with IDSP and RP • How can the IDSP and RP trust each other? * Source OIX

15. Should we have Trust in Trust Frameworks • Key question how much do we trust the identity enrolment stage • Do we Trust Breeder Documents and verification process? • The Elephant in the room; The rise of Synthetic ID • So what are Synthetic ID? • Synthetic identity happens when a criminal steals bits and pieces of info from different people and creates a new identity with No Carbon Copy. • A social security number is used with a different name and date of birth. • Difficult to detect because of all the mismatched pieces of information. • Criminals are getting bold • Trend to claim ID Theft as opposed to account busting • Need better means of validating breeder documents • Not all breeder documents are Trustable

16. Directions Some Pain Points • Internet transactions are anonymous (low trust) • Value transactions are identity based • Anonymous to identity enabled • Need strong authentication and contextual identification of identities • Enable Identity based systems • while protecting privacy (PII) • Isolation of Issuer and target Identity • Enable the right to forget • Identity dashboard for user to keep control identity and related data (Data Ownership) • Consumer Protection and Identity Service Provider Liabilities • Audit, compliance and policy enforcement • And yes…..Simple to use system

17. Current Trends • OIDF WG on Street Identity (see www.streetidentity.com ) • OAuth2 and OpenID Connect • Focus on Eliminating password reuse (one password) • Identity verification • Use of Relationship Manager or Attribute provider to share legal identity (name/address) with a requesting party • Toward Strong authentication • Secure the "one password" with additional protection • Potentially the use of Secure Vault technology in devices an immutable, provision-able, isolated  NVM to store its identity • Programmable RD/WR/OTP/ERASE capable • Scalable cross devices (power, form factor, standard) • Ultimately needs to have appropriate crypto support

18. Q&A