From a gaggle of breaches — thousands of major ones a year, at least two or three annually for most organizations — the trade press and analyst circles have rightfully gone into lessons-learned mode. Against that backdrop, I’m hoping my predictions will nudge the discussion forward — to the inflection point where we take those lessons learned and use them for concrete action!

Authentication will rise with the demand of zero trust
Just as 2017 became known as the Year of the Data Breach (as Bloomberg called it), 2018 was the year where Zero trust security models took center stage as a viable security and identity management response. Now everybody’s starting to realize zero trust has zero value unless it’s backed by strong authentication. Without mature authentication, identity management and Privileged Access Management (PAM) that’s scalable and dynamically adjusts based on policies, it’s hard to apply zero trust without slowing down the speed of business. That’s why we’ll be seeing more and better authentication solutions to prevent zero trust from operating at zero speed.

Social media fraud and political meddling will continue unless providers get serious about authentication
This deserves to be its own list item, given the global scale of adoption and the outsized role authentication plays in social media —- identities don’t just get stolen, they’re also replicated, made up, curated and endlessly morphed for fraud, election tampering and other purposes. How can we afford not to get serious about authentication? And it’ll take more than just voicing support or joining an industry consortium. Signs that a company is serious include deploying standards and making them mandatory, support for legislation and embracing transparency by sharing actual metrics and other data.

The variety of biometrics will continue to grow
The industry will keep churning out new forms of traditional and behavioral biometrics, thanks to a confluence of technical innovation and evolving standards like FIDO that simplify and streamline how biometrics are used in all kinds of industries. As this continues, businesses will have more and more options and we’ll get closer to a plug and play level of interoperability — think of how your blender, toaster and microwave can all operate on the same kitchen power strip and you begin to see what’s possible.

The global regulatory environment will become more challenging.
If strong authentication and other cyber protections don’t seem like a good business idea by now, they will after you remember how upwardly steep the curve toward regulation has been. And given rising complaints and the number of breaches, there’s no sign of it slowing anytime soon. You’ll see more data privacy protection as was done with GDPR. While this is a great progress, we’re going to see more challenges in the form of stronger enforcement, steeper fines and more demands for company data.

The sports and entertainment industry will continue to be a growth area for biometrics
This final prediction comes not just from the market trends we’re seeing, but also personal experience. As I saw firsthand from the misery on my teenage niece’s face at the box office window when she learned the ticket she bought online was a fake — valuable experiences can be stolen, just like valuable products or data. Not surprisingly, biometrics in both sports and entertainment will keep rising. Whether verifying identity for entry and seating, or age for drinking alcohol, entertainment venues and systems have a host of use cases just waiting for strong authentication to solve.

These are the dynamics that will more or less shape the industry in 2019. And while it’s impossible to predict every development or impact, I’ll consider this post a success if we can at least shift the focus onto action — new levels of commitment to put ideas and lessons learned into practice for better authentication and identity management.

A team of researchers at Paragon Initiative recently shared a few security concerns related to some cryptographic algorithms in WebAuthn—a web authentication API protocol. In an August 23 blog post, the Paragon team provided an overview of the potential issues they feel WebAuthn is exposed to as a result of vulnerabilities with underlying or supported algorithms. The research is thorough, and the effort to educate users is admirable. However, the security concerns should also be considered in context and with the understanding that how the protocol is implemented plays a significant role.

WebAuthn specification supports different algorithms, some of which are stronger than others. That is a challenge faced by virtually every standard. Standards bodies typically strive to address the widest possible audience and cover the widest range of products or services in an effort to maximize adoption and market reach. The need for backward compatibility and interoperability with other platforms and standards opens the door to potential weaknesses that exist in legacy or third-party components.

It is what you do with the standard that matters.

The overall strength of a security solution depends on the availability of necessary security infrastructure elements and—most importantly—the strength of the implementation. A good implementation needs to be flexible and provide a framework to allow service providers to make the best choices based on the strengths of the incoming device requests. In the cases where there are weaker devices involved, additional steps need to be taken to validate incoming data and mitigate the underlying risk.

The article from Paragon raises two primary areas of concern: signature forgery vulnerabilities inherent to RSA PKCS1v1.5 padding, and potential weaknesses in the use of ECDAA. WebAuthn is a web authentication API and web browsers add a layer of complexity, interfaces, and APIs above and beyond the operating system. The expanded attack surface opens the door to a variety of possible attacks that are not a function of WebAuthn itself.

The concerns raised by Paragon are not an issue for products from Nok Nok Labs. Nok Nok Labs has deployed products that implement FIDO protocols globally and at a massive scale for the past 4 years. We endorse high security standards and implementations—and that includes scenarios with WebAuthn as well.

Customers who rely on Nok Nok Labs products can specify acceptable algorithms and authentication characteristics through policy. This enables our customers to detect and potentially block weak implementations and mitigate exposure to risk resulting from weaknesses in specific underlying algorithms. It also allows customers to assign risk scores to specific authenticators that use weak or vulnerable algorithms. Using the risk scores provides an opportunity for customers to require additional step-up authentication for improved security, delay the transaction, or take other appropriate measures to reduce risk and ensure strong security.

Nok Nok Labs gives customers the flexibility to limit exposure to these types of flaws through configuration and policy. We also give customers the ability to identify scenarios that are higher risk and require step-up authentication to provide additional protection.

Nok Nok Labs is a founder and strong supporter of FIDO and we stand by WebAuthn. We also recognize that there are potential security concerns inherent with developing a general standard that provides backwards compatibility and interoperability, and the steps that must be taken at the implementation level to address them.

For further questions or comments, please contact Nok Nok Labs ([email protected]).

The reporting by Bloomberg and early disclosures from Uber indicates that the root cause was once again a credential compromise (stolen login credentials from a cloud-based storage system used by its developers). That attack allowed a small lapse in security to spiral into a huge liability for the brand and the business.

While others may gloat at Uber’s misfortune, sadly, this is par for course in the industry. The usage of credentials (passwords, legacy OTP) that can be stolen, phished or attacked by man-in-the-middle is rampant. Such neglect hasn’t risen to board level attention or there would be rush to modernize credential systems to protect against such attacks.

It is a well-documented fact in neuroscience research that individuals are very poor at assessing risk.  We worry about terrorist events when we are far more likely to be crushed by furniture.  We spend millions of dollars on dubious pills when a short walk around the block would do more to extend our lifespan.   We are two times more likely to be attacked by a vending machine than a shark, yet the term “Jaws” is more often associated with the gilled variety than the human.

Corporations are no different.  In an age of threats such as weak credentials that stand to damage their customers, that can gut the value of their brand and jeopardize the course of their business – they persist in irrational actions and investments in when simple measures like prioritizing modern strong authentication practices would eliminate many of the threats they face to their business.

The First Horseman of the Breach Apocalypse: Weak Credentials

Weak credentials make up the First Horseman of the Breach Apocalypse and he will mercilessly continue to cut down leaders and businesses that persist in using them.

Most of the industry today is locked into shamefully weak and insecure authentication practices based on password management, legacy OTP systems that are symmetric shared secrets. These practices are vulnerable to phishing and malware and lead to scalable attacks that can harvest credentials for more damaging uses.  Verizon’s 2017 Data Breach Investigations Report documents that 81% of the data breaches involve a compromised credential.

Further, these businesses irrationally pour millions of dollars into firewalls/intrusion-detection/APT systems, home-grown or proprietary authentication systems ahead of investing in strong standards-based modern multi-factor authentication.

There is salvation from the First Horseman of the Breach Apocalypse – widely deployed, market tested and universally endorsed standards like those from the FIDO Alliance can provide phishing and MitM resistant strong, multi-factor, password-less authentication that is simple for users, developers and IT staff to manage.

There are other Horsemen (patching, encryption and others) to be sure and the nature of living in the modern connected world involves risk.  The trick is to do the simple things that allow you to fend off the Horsemen and to limit the damage that attackers can do to your brand and customers.  That and take a walk around the block…avoiding vending machines.

One of the most popular attractions at the mothership event in Barcelona is Innovation City. Here the GSMA – and their key innovation partners – show how the “power of mobile” is transforming lives across the world. This year, the GSMA is putting on a mock urban environment to showcase what modern, mobile-centric identity solutions can provide. Digital identity is truly at the heart of what an innovative city could look like.

The GSMA’s Mobile Identity Initiative

In February of 2014, the GSMA launched “Mobile Connect” – a solution that enables end-users to create and manage a digital universal identity through a single log-in solution. Mobile Connect provides a federated framework through which 3rd party service providers can authenticate users, seek their authorization of transactions and access information about the user (with user consent). This service has been deployed to a significant portion of the world-wide mobile network operator marketplace and is commercially available to over 3 billion consumers globally.

Mobile Connect performs what Nok Nok Labs refers to as the “Second Mile” of authentication. Where the “first mile” of authentication is proving the identity of the person using the device, the so-called “Second Mile” is proving that that person should have access to that account with the specific privileges.

Nok Nok Labs and Mobile Connect

In 2016, Nok Nok Labs launched a “Jumpstart Program for Mobile Connect”, helping mobile network operators worldwide deliver a biometric-enabled, FIDO-Certified customer authentication experience via Mobile Connect.

FIDO-based authentication and Mobile Connect go hand-in-hand. The “first-mile” of the authentication is handled by Nok Nok Labs’ S3 Authentication Suite, leveraging the FIDO UAF protocol. This allows Mobile Connect to use the built-in biometric authenticators on smartphones, tablets, and PCs – increasing the range of authentication options beyond historic, potentially less-secure alternatives. A user – prompted by the Mobile Connect application – proves their identity to their devices with a biometric. This proof is then passed to the GSMA’s identity gateway where the second-mile of authentication happens leveraging an API exchange and the OpenID connect protocol to further identify and confirm the details of an individual user.

Further validating the synergies possible between the FIDO Protocol and Mobile Connect, earlier this year, the GSMA and the FIDO Alliance formalized a liaison partnership to further explore how FIDO Authentication and Mobile Connect fit together from both a technical and market perspective.

See Mobile Connect in Action

In just a few weeks, at the Innovation City in the heart of Mobile World Congress: Americas, Mobile Connect will be front and center. Nok Nok Labs is proud to be part of this demonstration arena, helping power demonstrations from Visa, InterBev and San Diego Health Connect. The Innovation City will be located in the South Hall of Moscone Center, stands S.1428 & S.1128. You can visit with a Nok Nok Labs representative there during Innovation City hours (9:00 AM to 5:00 PM), or you can stop by the Nok Nok Labs booth in the North Hall at stand N978 (we will be part of the FIDO Pavilion).

Dig a little deeper and you will understand that Bitcoin is an implementation of a “distributed ledger” that is called a blockchain. Rather than keeping critical records in a central database like almost every company does today, blockchains distribute the ledger information to many different computers. Then when a process requires information from the ledger, it asks all the connected machines to propose the answer. When a majority agree, they are rewarded for their efforts in the form of digital coins. If information on one machine was manipulated, the majority would still be trusted.

A couple of years after Bitcoin was released, some in the cryptocurrency community began to think about making the blockchain more powerful. Rather than just holding information, what if the blockchain could hold a program that executed when triggered? Developers released a new type of blockchain with a specialized programing language that could be used to write “smart contracts”. This new chain was called Ethereum. These smart-contracts have made it easier for teams to build applications that use these distributed network effects. Infact, these applications have a name (dApps) and sometimes even have their own digital coins (altcoins).

Regardless, today, blockchain aficionados think of Bitcoin and Ethereum as the two major public blockchains that should be considered for business functionality, and with this operating model, blockchains become an interesting architecture for managing identity.

Identity on the Blockchain

As much as you’d like to think you control your identity, you really don’t. Vast repositories of information about you are controlled by private companies that make money every time another company needs to validate who you are. Today, we have an identity ecosystem that requires thousands of organizations to pay these identity holders to perform some sort of “proofing” to validate that a user is who they claim to be:

• Your utility company may have validated your address.
• Your bank may have validated your payroll.
• Your hospital may have validated your birth.
• Your government may have validated your SSN.
• Your mortgage company may have validated you creditworthiness.

Each of these organizations have invested in due diligence in “know your customer” processes, and they each now have a piece of the total identity puzzle that is you. But each new credit check requires yet another set of validations, and in the end, your identity gets spread wider and wider into more centralized databases that can be hacked.

With blockchain, we can fundamentally change how management of identity takes place.

First let’s start with a radical premise – that you should own your identity information, and should be able to control who sees it – and even be compensated when your information is valued by someone else.

Now Imagine an app called MyID that you install on your phone for a small fee of $1.99. This app – tied to your phone becomes the trusted digital wallet of your identity. Using your biometrics, only you can access the app, and the biometrics data and the identity data all sit within your phone and are never transferred to a server elsewhere without your permission.

Once your app is installed, you go through an identity proofing process where you answer questions that allows MyID to validate who you are and issue a certification for each piece of identity that it validates. These certificates live in the blockchain and therefore can’t be altered, and the underlying data sits encrypted on your phone and also can’t be altered.

With this model, you have a favorable configuration for the consumer. They can share proof that MyID has validated their identity (tied with the device), or they can share the underlying identity data piecemeal as they see fit.

If a credit card company wants to issue you a credit card, they can request various data points, and may give you more credit or a lower rate if you provide more certified identity data.

If an online advertising company wants to better target advertisements to you based on your income, you can share your certified income level (but not your contact information) with them for a fee (payable to you) for a piece of every advertisement you look at – which can be managed on a different blockchain.

Large companies are not left out of this loop. If your mobile network operator already has identity data about you, they can contribute that information to you and can certify if. Now when a third party wants that info, both you and the MNO can get a cut of the fees with your permission.

With blockchain technology, we have the opportunity to reframe risks of identify theft, while also bringing stronger privacy and digital rights to end consumers. There are many reasons why this is the future architecture of identity – and consequently there are many reasons why incumbent organizations will do whatever they can to delay or prevent it from emerging.