Identity Theft and Online Identity Solutions Heidi Inman May 29, 2008

Identity Theft Defined Fraud that involves stealing money or getting other benefits by pretending to be someone else. Fraud that involves stealing money or getting other benefits by pretending to be someone else. The term is relatively new and is actually a misnomer, since it is not possible to steal an identity, only to use it. The term is relatively new and is actually a misnomer, since it is not possible to steal an identity, only to use it.

Types of Identity Theft Financial Identity Theft – using anothers identity to obtain goods/services Financial Identity Theft – using anothers identity to obtain goods/services Criminal Identity Theft – posing as another when apprehended for a crime Criminal Identity Theft – posing as another when apprehended for a crime Identity Cloning – using anothers information to assume his or her identity in daily life Identity Cloning – using anothers information to assume his or her identity in daily life Business/Commercial Identity Theft – using anothers business name to obtain credit Business/Commercial Identity Theft – using anothers business name to obtain credit

Techniques for Obtaining Personal Information Researching about the victim in government registers, internet search engines, or public record search services Researching about the victim in government registers, internet search engines, or public record search services Stealing personal information in computer databases (Trojan horses, hacking) Stealing personal information in computer databases (Trojan horses, hacking) Phishing - Impersonating a trusted company/institution/organization in an electronic communication to promote revealing of personal information Phishing - Impersonating a trusted company/institution/organization in an electronic communication to promote revealing of personal information

Techniques for Obtaining Personal Information Cont. Browsing social net sites such as MySpace and Facebook for personal details that have been posted by users Browsing social net sites such as MySpace and Facebook for personal details that have been posted by users Remotely reading information from an RFID chip on a smart card, RFID-enabled credit card, or passport Remotely reading information from an RFID chip on a smart card, RFID-enabled credit card, or passportRFID

Actions taken by the United States Identity Theft and Assumption Deterrence Act Identity Theft and Assumption Deterrence Act Makes the possession of any means of identification to knowingly transfer, possess, or use without lawful authority a federal crime. Makes the possession of any means of identification to knowingly transfer, possess, or use without lawful authority a federal crime. Punishment can be up to 5, 15, 20, or 30 years in federal prison, plus fines, depending on the exact crime. Punishment can be up to 5, 15, 20, or 30 years in federal prison, plus fines, depending on the exact crime. Gives the Federal Trade Commission authority to track the number of incidents and the dollar value of losses. Gives the Federal Trade Commission authority to track the number of incidents and the dollar value of losses.

FTC Stats ID Theft is fastest growing crime in America ID Theft is fastest growing crime in America 2003 estimate was that identity theft accounted for $52.6 billion of losses in the preceding year alone 2003 estimate was that identity theft accounted for $52.6 billion of losses in the preceding year alone Affected more than 9.91 million Americans Affected more than 9.91 million Americans Average fraud per person rose from $5,249 in 2003 to $6,383 in 2006 Average fraud per person rose from $5,249 in 2003 to $6,383 in 2006 Average amount of time spent by victims resolving the problem is about 40 hours Average amount of time spent by victims resolving the problem is about 40 hours

Fighting Identity Theft Single Sign-On (SSO) – a method of access control that enables a user to authenticate once and gain access to the resources of multiple software systems. Single Sign-On (SSO) – a method of access control that enables a user to authenticate once and gain access to the resources of multiple software systems. Single Sign-Off – the reverse process whereby a single action of signing out terminates access to multiple software systems. Single Sign-Off – the reverse process whereby a single action of signing out terminates access to multiple software systems.

Implementations of Single Sign-On Windows Live (Originally.NET Passport) – developed and provided by Microsoft Windows Live (Originally.NET Passport) – developed and provided by Microsoft Allows users to log in to many websites using one account Allows users to log in to many websites using one account Hotmail Hotmail SAML (Security Assertion Markup Language) – used for Google Applications SAML (Security Assertion Markup Language) – used for Google Applications Gmail Gmail

Challenges and Advantages to Single Sign-On Biggest challenge is getting long-time users whove customized their own links and methods for accessing online services to change. Biggest challenge is getting long-time users whove customized their own links and methods for accessing online services to change. Advantages include reducing the amount of internal fraud by malicious employee contact, convenience of password access, security on all levels of entry/exit/access to systems, and centralized reporting for compliance adherence. Advantages include reducing the amount of internal fraud by malicious employee contact, convenience of password access, security on all levels of entry/exit/access to systems, and centralized reporting for compliance adherence.

Real ID Act Real ID Act National ID Cards – electronically readable, federally approved ID cards for Americans. National ID Cards – electronically readable, federally approved ID cards for Americans. If you live or work in the United States, youll need a federally approved ID card to travel on an airplane, open a bank account, collect Social Security payments, or take advantage or nearly any government service. If you live or work in the United States, youll need a federally approved ID card to travel on an airplane, open a bank account, collect Social Security payments, or take advantage or nearly any government service.

National ID Card What will be stored on this card? What will be stored on this card? Name Name Birth Date Birth Date Sex Sex ID Number ID Number Digital Photograph Digital Photograph Address Address Common Machine-Readable Technology Common Machine-Readable Technology

National ID Card cont. Positives Positives Reduce Fraud Reduce Fraud Combat Terrorism Combat Terrorism Improve Airline Security Improve Airline Security Negatives Negatives Potential to be misused by thieves with RFID readers Potential to be misused by thieves with RFID readers Could promote irresponsible national behavior Could promote irresponsible national behavior

Open ID Open ID Better way to identify a person/organization on the internet. Better way to identify a person/organization on the internet. A shared identity service. A shared identity service. Allows Internet users to log on to many different web sites using a single digital identity. Allows Internet users to log on to many different web sites using a single digital identity. Eliminates the need for a different user name and password for each site. Eliminates the need for a different user name and password for each site. Lets users control the amount of personal information they provide. Lets users control the amount of personal information they provide.

Sources "SAML Single Sign-On (SSO) Service for Google Apps". 5/28/2008. "SAML Single Sign-On (SSO) Service for Google Apps". 5/28/2008. "Windows Live ID". 5/28/2008. "Windows Live ID". 5/28/2008. "Single Sign-On". 5/23/08. "Single Sign-On". 5/23/08. Christopher, Dawson. "Single signon portal makes sense for university". ZDNet Education. 5/23/08. Christopher, Dawson. "Single signon portal makes sense for university". ZDNet Education. 5/23/08. "Identity Theft". 5/23/08. "Identity Theft". 5/23/08. "REAL ID Act". 5/28/08. "REAL ID Act". 5/28/08. Jon, Oltsik. "An easier identity solution". CNET News.com. 5/27/08. Jon, Oltsik. "An easier identity solution". CNET News.com. 5/27/08. Declan, McCullagh. "FAQ: How Real ID will affect you". CNET News.com. 5/27/08. Declan, McCullagh. "FAQ: How Real ID will affect you". CNET News.com. 5/27/08. Declan, McCullagh. "National ID cards on the way?". CNET News.com. 5/27/08. Declan, McCullagh. "National ID cards on the way?". CNET News.com. 5/27/08. "OpenID". 5/28/08. "OpenID". 5/28/08.