Dissecting all the buzz about Identity Assurance

One of the big buzzwords this past month or so has been “Identity Assurance“. Liberty Alliance made a big push for the Identity Assurance Framework (IAF)at DIDW last month, conducting a number of sessions/workshops introducing it to the masses. Our old friend Frank Villavicencio, who is a co-chair of the IAEG, was a star at the show, even collecting a Liberty Alliance IDDY award. At OpenWorld, Oracle announced the formation of the Oracle Identity Assurance Partner Alliance, an initiative focused on extending our identity and access management offerings with comprehensive and proactive identity fraud prevention solutions from strategic partners (you can read the press release for details).

So what exactly is Identity Assurance? Simplistically, Identity Assurance is the ability to determine, with some level of certainty, that the person (identity) presenting themselves in an identity transaction is who they are claiming to be. The level of certainty one can have about the presented identity is what is referred to as the “Assurance Level”. Identity Proofing is another term that is used in this context (and that I have used in the past), though it is more commonly associated with the verification of ones real world identity during the registration process.

So what are these two initiatives, and how are they related?

Identity Assurance Framework – Think TRUSTe for IdPs

The IAF is coming at the Identity Assurance discussion purely from the authentication angle, especially within federation contexts. It is based, in part, on the Electronic Authentication Partnership Trust Framework and the US E-Authentication Federation Credential Assessment Framework, initiatives designed for the sole purpose of enabling interoperability among electronic authentication systems. As such, it attempts to define a trust framework around the quality of claims issued by an IdP based on language, business rules, assessment criteria and certifications.

The IAF has published a standard set of assurance levels regarding the authentication of the user (Level 1 means low assurance, Level 2 means medium assurance, and so on. As of today, there are only 4 levels of assurance, Level 4 being the highest level). When a digital token is issued, it states the level of assurance at which the user was authenticated – Level 1 through Level 4.

The IAF defines a certification process through which an independent auditor assesses whether the issuers interpretation of Level 1-4 meets a standard assessment criteria established by IAF. So one issuer may have used a RSA SecureID token in combination with Username-Password to issue a Level 2 token, while a second issuer may have used a biometric challenge in addition to a UserID-PIN to issue a Level 2 token. The RP receiving the token from both issuers simply knows that both tokens are Level 2, and doesn’t know/need to know what the actual mechanics were, simply that an audit process certified that the mechanism for generating the token meets the criteria laid out by Liberty IAF.

The IAF is NOT defining any technology or standard protocols. In this sense, the IAF is trying to set up something analogous to the way TRUSTe verifies and asserts through their web seal that an eCommerce site is trustworthy.

Oracle Identity Assurance Partner Alliance – Tools of the Assurance Trade

Oracle IAPA aims at extending Oracle’s Identity Management Suite with partner technologies that offer capabilities such as identity proofing, internet geolocation, multi-factor authentication, out-of-band authentication, endpoint security and secure remote access. As such, its charter is pretty broad in combating identity fraud and providing context-aware security, and this encompasses identity assurance.

There are no doubts about it, identity fraud can have devastating consequences. That being said, there are a number of steps that can be taken to protect your identity so that you can significantly limit your chances of falling victim to this type of crime. It might seem intuitive, but you should always shred your confidential documents. This is particularly important if you work in an office environment and handle large amounts of data. Above all, carefully destroying any sensitive or confidential documents can protect your own privacy as well as the privacy of your employees, clients, and customers.

Companies nowadays may be making an accelerated move to the digital space, in which case it becomes important to protect sensitive company data on any and all digital platforms as well. Moreover, measures taken to prevent or detect any attempt at fraud should also encompass all of the processes and systems of an organization, ensuring a high level of security. In spite of it all, if there occurs a data breach or attempt at identity theft, advanced digital forensics tactics could come into the play to help resolve the issue at the earliest. Advances in technology have proven to be both a blessing and a risk for businesses all around the world.

However, since the time machine learning-powered fraud analytics has come into play for fraud prevention and detection, it has become possible to detect fraudulent events in real-time to protect organizational assets and reputation. Successful machine learning programs include a component of continuous experimentation. It is not sufficient to create a machine learning model and then let it crunch. Fraudsters are astute, and technology is rapidly evolving. A sandbox in which data scientists can freely experiment with a variety of methods, data, and techniques to combat fraud has become an essential component of top fraud analytics programs. Investing in increasing the capacity of data scientists who combat fraud yields almost immediate results. Given the increasing number of fraudulent cases on a daily basis, Corporate Fraud Prevention has become a necessity. In the event of such occurrences, you can contact companies that develop fraud detection software.

Also, the solutions in the IAPA can provide the underlying mechanism by which an IdP can support the main tenet in the IAF, wherein an assertion can be trusted (at varying levels of assurance) to really belong to the entity represented. The IAPA steps in as a way for Oracle IAM to leverage technologies that enhance an authentication process with additional “challenges” that up-level the authentication assurance to the appropriate level – whether it be by using a biometric challenge, a voice challenge, a knowledge challenge based on external data aggregators, etc. So Oracle IAM + IAPA is positioned nicely to be the execution/implementation arm of an IdPs IAF compliance efforts.

Looking To Tie Them Together

One thing I will be exploring is the possibility of having the IAPA stack go through the Liberty IAF audit process. Then any customer deploying Oracle Access Management in conjunction with one of our partners would immediately know the IAF assurance levels of the authentication tokens being issued. Conversely, a customer that is targeting being able to issue credentials of certain assurance levels will be able to identify the solutions that will meet their need.