Aspects of Identity. InfoSec April BCS Security Community of Expertise

Transcription

1 Aspects of Identity InfoSec April 2011 BCS Security Community of Expertise

2 SCoE Representatives Dr. Louise Bennett FBCS CITP Chair of the BCS Security Community of Expertise Ian Fish FBCS BCS Information Security Specialist Group Andy Smith MSc CEng FBCS CITP FSyI Information Assurance Specialist Peter Wenham BSc FBCS Security Consultant David Williams OBE MSc CEng FBCS CITP Security Consultant 2

3 Agenda Introduction Louise Bennett Outlines of issues 5 Topics Citizens Rights & Control of Personal Data: Minimising Access & Protecting Privacy: Registration Authorities & ID Assurance: Rights & Responsibilities of ID Providers: Security v. Privacy, The Balancing Act: Please Save questions for discussion Round Table discussions Feedback from tables Louise Bennett Ian Fish Andy Smith Peter Wenham David Williams 5 minutes 40 minutes 45 minutes 30 minutes 3

4 Points of Admin In case of a fire Try to keep up This session is being recorded under the Chatham House Rule to allow the talks and Feedback to be transcribed. The recordings may be published on the website in which case all names and affiliations will be removed. 4

5 Introduction Who is British Computer Society (BCS)? Why Identity Management & Identity Assurance? What do we aim to achieve? How do we aim to achieve it? 5

6 Citizens Rights & Control of Personal Data Dr. Louise Bennett

7 Avatars How we appear to others 7

8 Keeping control 8

9 The right to share 9

10 Questions 1. When we identify someone, we sometimes want to establish that they are a unique biological being as recorded on their birth certificate and sometimes that they are the same persona who did something at a different time. - What are the implications of this for the successful running of a multi-level Identity Assurance scheme? 2. How can an individual control access to their biographic data (and biometric data) after enrolment in an identity scheme? 3. What responsibilities should the citizen (identity subject) accept to ensure the Identity Assurance information held by the provider remains accurate and current? 10

11 Minimising Access & Protecting Privacy Ian Fish

12 Consent 4 Types 12

13 Personal Information is Everywhere 13

14 Centralised database 14

15 One-way Trust 15

16 Questions 1. How do organisations balance need-to-know against need-to-disclose to protect clients privacy? 2. How do organisations establish a culture of privacy, to ensure that clients privacy needs are properly addressed from initial system proposals through to end of life decommissioning? 3. How can the conceptually-difficult and mathematicallyabstruse ideas of advanced privacy enhancing technologies be made accessible to the general public and business decision makers? 16

17 Registration Authorities & Identity Assurance Andy Smith

18 Identity - Fundamentals 3 Main sets of data: Those intrinsic to you when you are born Those assigned to you by others Those you get as you interact with the world Wider Identity History Identity Credentials Skills Identity Services Social Interactions Parents Recorded DoB Links Reference Numbers Qualifications Persona s Biological parents Date of Birth Related Attributes Assigned Attributes Immutable Attributes Physical Person Biometrics Recorded Biographics Biographical Footprint Name(s) Gender at birth Place of Birth Government Interactions Titles Nationality Relationships Gender Health Signature Memberships Entitlements Address(es) Attribute Context Religion 18

19 Establishment - Existence Unique ID Creation Events Exist Evidence it Exists in Society Attributes Can Be Corroborated The Claimed Identity Exists Claimed Events Can Be Corroborated There Are No Unresolved Anomalies Evidence it Exists in History No Evidence of Death / Non-use Identity Used Recently and Regularly 19

20 Establishment - Provenance Person Matches Biometrics Provenance Can Be Confirmed Person Has Original Documents Claimant Owns This Identity Person Knows The History Intimately Identity Not Been Claimed Before Identity Matches Profile Claimed Gender/Ethnicity/Origin fits Claimant Attributes Consistent With ID 20

21 Establishment Linking & Recording Identity Recorded and linked to individual Identity is Unique Claimed Persona s Link to This ID Claimant Does not Appear to have other Identities Identity Immutably Linked With Claimant Biographic Attributes Recorded Biometrics Recorded Credentials Issued Identity Lifecycle Managed 21

22 So what is Identity? My view An Identity is the person as perceived by others The bit of wet carbon and all associated attributes All the attributes and relationships that a person has and how they interplay with each other throughout their life Registration Authorities need to be clear about the context of an identity registration Only Government actually needs to record a core (level 3) identity. Others can if they want 22

23 Questions 1. What is a core identity, what attributes make it up? 2. Should biometrics be used as part of an identity, if not what else would offer an immutable link between the person and the identity? 3. Who should have the authority to register a core identity and perform the level of background checks needed to establish identity beyond reasonable doubt? 23

24 Rights & Responsibilities Of Identity Providers Peter Wenham

25 Example Rights & Responsibilities Identity Provider (Government or Commercial) Registration Authority Service Provider Central or Regional Government InfoSec

26 A Possible Solution Identity Provider (Government or Commercial) Managed Service Service Provider Central or Regional Government HUB (Portal) Attribute provider Biographical Data Attribute provider Health Data Attribute provider Attribute provider Wealth Data Education Data InfoSec

27 A Worked Example Local Authority HUB Service DVLA Car Registration Details DWP Database Customer s Official Address InfoSec

28 Questions 1. The whole concept of Identity Assurance is a bit big brother so how do you go about ensuring that Jack and Jill Doe Trust the process? 2. How can we ensure that an individual (or persona) is who they say they are when they request a service, and if something goes wrong will there be a speedy restitution and redress process? 3. Will it be up to the individual to ensure that any information held by an Identity Provider is up to date and accurate (a responsibility), or is an individual s right that the information is correct in the first place? Is it a case of ignorance is no defence! 28

29 Security versus Privacy The Balancing Act David Williams OBE

30 Balancing Act 30

31 National Security 31

32 Right to Privacy 32

33 Questions 1. What principles need to be in place to ensure an individual s right to freedom of opinion and expression (and why)? 2. In the context of Identity Assurance what are legitimate National Security Interests (and why)? 3. What safeguards should be in place to ensure that personal privacy is protected whilst not compromising national security? 33

34

35

36 Please leave your contact details and you will be sent the feedback from this session. Visit the website at: