1. International Telecommunication Union ICT Security Role in National Trusted Identities Initiatives Abbie Barbir, PhD ITU-T Study Group 17 Identity Management Rapporteur Abbie.Barbir@ties.itu.int

2. 2 27-28 May 2004 ITU-T Geneva

3. 3 ITU-T Objectives History Established 17 May 1865 Decisions by consensus (voting almost never occurs) Participation through national Government channels Telecom does not mean that focus is only on Telecom Objectives Develop and publish standards for global ICT interoperability Identify areas for future standardization Provide an effective forum for the development of international standards Disseminate information and knowhow Cooperate and collaborate ITU-T Key Features Truly global public/private partnership 95% of work is done by private sector Continuously adapting to market needs Pre-eminent global ICT standards body

4. 4 Study groups (2009-2012) SG 2Operational aspects of service provision and telecommunications management SG 3 Tariff & accounting principles including related telecommunication economic & policy issues SG 5Environment and climate change SG 9Television and sound transmission and integrated broadband cable networks SG 11Signalling requirements, protocols and test specifications SG 12Performance, QoS and QoE SG 13Future networks including mobile and NGN SG 15Optical transport networks and access network infrastructures SG 16Multimedia coding, systems and applications SG 17 Lead study group on telecom security, identity management (IdM) and languages

5. 5 SG 17 structure WP 1WP 2WP 3 Network and information security Application security Identity management and languages Q10 IdM Q11 Directory Q12 ASN.1, OID Q13 Languages Q14 Testing Q15 OSI Q8 SOA Q9 Telebiometrics Q7 Applications Q6 Ubiquitous services Security project Q1 Q2 Architecture Q3 ISM Q4 Cybersecurity Q5 Countering spam

6. 6 Identity management (IdM) (Q10/17) Motovtaion IdM is a security enabler by providing trust in the identity of both parties to an e-transaction Provides network operators opportunity to increase revenues through advanced identity-based services Focus on global trust and interoperability Leveraging and bridging existing solutions Current Recommendations o Identity management X. 1250 Baseline capabilities for enhanced global identity management trust and interoperability X. 1251 A framework for user control of digital identity X. 1252 Baseline identity management terms and definitions X.1253 (X.idmsg), Security guidelines for identity management systems X.eaa/ISO 29115, Entity authentication assurance framework X.atag, Attribute aggregation framework X.authi, Guideline to implement the authentication integration of the network layer and the service layer X.discovery. Discovery of identity management information X.giim, Mechanisms to support interoperability across different IdM services X.idmcc, Requirement of IdM in cloud computing X.idmgen, Generic identity management framework X.idm-ifa, Framework architecture for interoperable identity management systems X.mob-id, Baseline capabilities and mechanisms of identity management for mobile applications and environment X.oitf, Open identity trust framework X.priva, Criteria for assessing the level of protection for personally identifiable information in identity management Working with OASIS SAML 2.0 and XACML and their equivalent ITU-T Recommendations

7. 7 ITU-T Joint coordination activity in IdM JCA-IdM Q10/17 Coordination and collaboration on identity management

8. Q10/17 Future direction-Identity management o Interoperability of identity management X.giim, Generic IdM interoperability mechanisms X.idm-ifa, Framework architecture for interoperable identity management systems X.1250, Baseline capabilities for enhanced global identity management trust and interoperability o Trust of identity management X.authi, Authentication integration in IDM X.EVcert, Extended validation certificate X.eaa, Information technology – Security techniques – Entity authentication assurance X. OITF, Open identity trust framework o Discovery of of identity management information X.discovery, Discovery of identity management information o protection of personally identifiable information X.1275, Guidelines on protection of personally identifiable information in the application of RFID technology X.priva, Criteria for assessing the level of protection for personally identifiable information in identity management

9. Role of ICT in Trusted Identities What is NSTIC? o National Strategy for Trusted Identities in Cyberspace o Called for in President’s Cyberspace Policy Review (May2009) Guiding Principles Privacy Enhancing and Voluntary Secure and Resilient Interoperable Cost Effective Easy To Use o Promotes the development of an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities 9

10. NSTIC Main Drivers Usernames and passwords are broken People have many different passwords Password reused Strong passwords vulnerable o Identity Theft on the rise Large increase in financial institution Suspicious Activities $17.3 billion estimated cost to economy over 2 years (BJS,2008) o Cybercrime is on the rise Phishing continues to rise, with attacks becoming more sophisticated Main issue How to verify the Carbon entity on the other end of an online transactions Identities are difficult to verify over the internet Problem is more complicated in North America due to the lack of a government based national identity system Privacy remains a challenge o Individuals often are asked more personally identifiable information (PII) than that is needed o PII data is not well protected o No practical means for Individuals to control use of their PII data 10

11. Characteristics of the Identity Ecosystem Led by the private sector Enable participating consumers to: Acquire a single digital credential for wide use by many relying parties The ability to choose among a diverse market of credential providers use their credential when needed and remain anonymous when desired Enhances privacy through: “need-to-know” restrictions reduced identity theft reduced instances of sensitive information sharing

12. NISTIC Current Approach Private sector will lead the effort NSTIC is not a government run program Industry is to drive technologies and solutions Industry is best qualified to identify barriers and solutions Government provide support Working on a private sector led governance model Lead development of interoperable standards by example Provide clarity on national policy and legal framework around liability and privacy Act as an early adopter to simulate demand 12

13. Towards Digital Trust Enterprise Level o Major North American Telco are working on providing Identity Authentication Assurance services to the enterprise o Explosion of Mobile Smart Devices adoption is the Main Deriver o Services includes up to LOA 3 Assurance services include the use of context based identity authentication Use many forms of authentication (OTP, SMS, etc..) Some issues to consider How to ensure Subscriber versus a specific user authentication/identification How can the device be identified and tied to a particular user with the context of a given transaction. How to integrate browser based interaction and native application (they can use different technologies)

14. Device Identifications From Smart Device perspectives Cookie are increasingly becoming obsolete for device and user identification IP address is not reliable Different Approaches are used Identification in Browser based technologies (SAML, OpenID) is different from Native Application (Aouth2.0 and OpenID connect) Standards are needed Need to move towards interoperable cookie-less device independent identification methods in order to prevent fraud in financial transactions Support for cloud based interactions Support for interoperable token based services 14

15. Conclusions o Collaboration between Telco, financial with public and private institutions can play key role in enhancing Cybersecurity and enabling of chain of online trust o Value transactions are widely identity based, the key is how to enable Identity based interactions while protecting privacy (PII) o Isolation of Issuer and target Identity o Enable the right to forget o Identity dashboard for user to keep control identity o Enable audit, enforcement and policy enforcement o Transparent transaction message security o … and yes …Simple to use system

16. Q&A