Schools out for summer? Well not quite. Unless you’re living in the east coast of Australia, it’s looking decidedly bleak weather wise for most of Europe and the American east coast. But I digress. Is it looking bleak for your digital identity driven projects? What’s been a success, where are we heading and what should we look out for?
Where We Are Today
Passwordless – (Reports says B-)
Over the last 24 months, there have been some pretty big themes that many organisations embarking on digital identity and security related projects, have been trying to succeed at. First up, the age old chestnut…of passwordless authentication. The password is dead, long live the password! We are definitely making progress though. Many of the top public sites (Facebook, LinkedIn, Twitter et al) provide multi-factor authentication options at least. Passwords are still required as the first step, but the end user education and familiarity with something other than a password during login, must surely be the first steps to getting ridding of them entirely. 2018 also saw the rise of WebAuthn – the W3C standards based approach for crypto based challenge response authentication. Could this hopefully accelerate adoption to a password-free world?
API Protection – (Report says C+)
API’s will eat the world? Well, digital disruption needs speed, agility and mashups. API’s help organisations achieve those basic aims, but where are we, with respect to the protection of those API’s? API management platforms are now common in most enterprise architectures. They help to perform API provisioning, versioning and life cycle management, but what about security? Many use cases fall into the API security band wagon such as service to service authentication, least privilege authorization, token exchange and contextual throttling. Most API services are now sitting comfortably behind basic authentication, but fine grained controls and basic use cases such as token revocation and rotation are still in their infancy. Report says “we must do better”.
Microservices Protection – (Report says B-)
Not all API’s are microservices, but many net new additions to projects will leverage this approach. But microservices infrastructures, bring many new security challenges as well as benefits. Service versioning, same service load balancing, high through puts and fine grained access controls have created some new emerging security patterns. Both the side car and inflight/proxy approach for traffic introspection and security enforcement have appeared. Microservices by their design, normally means very high transactions per second, as well as fine grained access control – with each service performing only a single task. Stateless OAuth2 seems to fit the bill for many projects, but the consistency around high scale token introspection and scope design seems immature.
IoT Security – (Reports says C-)
Many digital disruption projects are embracing smart device (HTTP-able) infrastructures. Pairing those devices to real people seems a winner for many industries, from retail, insurance to finance. But and there’s always a but, the main interest for many organisations is not the device, but the data the device is either collecting or generating. Device protection is often lacking – default credentials, hard coded keys, un-upgradable firmware, inability to use HTTPS and the inability to store access tokens are all very common. There are costs and usability issues with increased device security and no emerging patterns are consistent. Several regulations and security best practice documents now exist, but adoption is still low.
User Consent Management – (Report says B-)
GDPR has probably had the biggest impact, from an awareness perspective, than any other piece of regulation relating to consent. The consumer, from a pure economic buyer perspective at least, has never been so powerful. One click away from a competitor. From a data perspective however, it seems the capitalist corporate machine is holding all the cards. Marketing analytics, usage tracking, location tracking, you name it, the service provider wants that data to either improve your service, or improve their ability to market new services. Many organisations are not stupid. They realise that by offering basic consent management functionality (contact preferences, ability to be removed, data exportation, activity viewing) they are not only ticking the compliance check box, but can actually create a competitive advantage by giving their user community the image of being at trusted partner to do business with. But will the end user be ever truly in control of their data?