1. Introduction of ISO/IEC 29003 Identity Proofing
ITU Workshop on “ICT Security Standardization for Developing Countries”
(Geneva, Switzerland, September 2014)
Introduction of ISO/IEC Identity Proofing
Patrick Curry
Director, British Business Federation Authority (& SC27 WG5)
Geneva, Switzerland, September 2014

2. Why is identity proofing so important?
Trust is globally, strategically essential
Authentication is key to trust
Strength of credential usually depends on strength of enrolment & registration
Core of enrolment is identity proofing and verification
Situation is evolving fast and becoming more complex
National eID
Employee credentials
Consumer credentials
Low and high maturities
Federation is key. Not to be confused with Mutual Recognition
Geneva, Switzerland, September 2014

3. Why is identity proofing so important?
Strength of credential usually depends on strength of enrolment & registration. But:
Anonymity
Partial anonymity
Pseudonymity
Depends on the use case
Geneva, Switzerland, September 2014

4. What is identity proofing?
Process from application to entry into a register = authoritative source
Questions
Does the identity exist?
Can it be bound to a real person?
Identity proofing
Checking the application & evidence of identity for Level of Assurance (LoA)
Checking binding to the subject
Verification
Examining corroborative sources of data
Looking for contra-indicators
No involvement with the subject
Geneva, Switzerland, September 2014

5. Business Administration
Identity vs PII
Identity
Identity proofing and verification
Eligibility
Capability
Service Delivery
Business Administration
Identity – the minimum number of attributes needed to determine one identity record from another. (core identity attributes)
Some information will be about establishing that the identity information is real.
Everything else is about eligibility, capability, business administration and service provision.
Some could be used for more than one aspect e.g. Date of birth
Identity – the minimum number of attributes that allow the person to be unique from all others in the context

6. Key points Identity is the minimum
One identity proofing process will always rely on other previous processes – unless it is the first.
Authentication is only the act of identifying a returning user.
Geneva, Switzerland, September 2014

7. The Key Entities Person Organisation Device Software Complicated
Much national variation
Organisation
Register(s) of Legal Organisations
6 categories of attributes; 2 mandatory
Device
TPM best practice – where do FIDO and IBOPS fit?
Secure issuance
Software
To be confirmed
Geneva, Switzerland, September 2014

8. The fast changing international situation
National cyber strategies
Cyber control frameworks
Pressure for strong authentication
New regulations
EU eID Authentication & Signature Regulations
Emerging US ID Verification standard
Many national e-ID programmes
More authentication requirements in supply chains
Geneva, Switzerland, September 2014

9. The role of international standards
Enable interoperability = agility
Enable deployment and affordability
Reduces risks and costs
Standards bodies need to:
Engage with governments and industry
Establish better coordination
Move faster
Geneva, Switzerland, September 2014

10. Conclusions and Recommendations
Too slow
Spread the load
Avoid gaps
Broadening communities
Based on national policies
Become more proactive
Collaborate with ISO and ?
Framework approach
Communicate better
Governments need to participate
Geneva, Switzerland, September 2014