1. Geneva, Switzerland, 15-16 September 2014 Introduction of ISO/IEC 29003 Identity Proofing Patrick Curry Director, British Business Federation Authority (& SC27 WG5) patrick.curry@federatedbusiness.org ITU Workshop on “ICT Security Standardization for Developing Countries” (Geneva, Switzerland, 15-16 September 2014)

2. Geneva, Switzerland, 15-16 September 2014 2 Why is identity proofing so important? Trust is globally, strategically essential Authentication is key to trust Strength of credential usually depends on strength of enrolment & registration Core of enrolment is identity proofing and verification Situation is evolving fast and becoming more complex National eID Employee credentials Consumer credentials Low and high maturities Federation is key. Not to be confused with Mutual Recognition

3. Geneva, Switzerland, 15-16 September 2014 3 Why is identity proofing so important? Strength of credential usually depends on strength of enrolment & registration. But: Anonymity Partial anonymity Pseudonymity Depends on the use case

4. Geneva, Switzerland, 15-16 September 2014 4 What is identity proofing? Process from application to entry into a register = authoritative source Questions Does the identity exist? Can it be bound to a real person? Identity proofing Checking the application & evidence of identity for Level of Assurance (LoA) Checking binding to the subject Verification Examining corroborative sources of data Looking for contra-indicators No involvement with the subject

5. Identity vs PII Identity – the minimum number of attributes that allow the person to be unique from all others in the context Identity Identity proofing and verification Eligibility Capability Service Delivery Business Administration

6. Key points Identity is the minimum One identity proofing process will always rely on other previous processes – unless it is the first. Authentication is only the act of identifying a returning user. Geneva, Switzerland, 15-16 September 20146

7. 7 The Key Entities Person Complicated Much national variation Organisation Register(s) of Legal Organisations 6 categories of attributes; 2 mandatory Device TPM best practice – where do FIDO and IBOPS fit? Secure issuance Software To be confirmed

8. Geneva, Switzerland, 15-16 September 2014 8 The fast changing international situation National cyber strategies Cyber control frameworks Pressure for strong authentication New regulations EU eID Authentication & Signature Regulations Emerging US ID Verification standard Many national e-ID programmes More authentication requirements in supply chains

9. Geneva, Switzerland, 15-16 September 2014 9 The role of international standards Enable interoperability = agility Enable deployment and affordability Reduces risks and costs Standards bodies need to: Engage with governments and industry Establish better coordination Move faster

10. Conclusions and Recommendations Too slow Spread the load Avoid gaps Broadening communities Based on national policies Become more proactive Collaborate with ISO and ? Framework approach Communicate better Governments need to participate Geneva, Switzerland, 15-16 September 2014 10