Yahoo

Comprehensive identity management

Balancing cost, risk and convenience

in identity management

Executive summary 3

Variables shaping identity management 4

Business costs to the organisation 4

Compliance 4

Technologies and approaches 4

Society at risk 6

Becoming sophisticated about risk 7

Balancing costs and risk 7

The importance of convenience 7

Users in the risk equation 8

Diversity and usability 8

Convenience, privacy and security 8

More advanced technology and solutions 9

Sharing responsibility 11

Moving towards an identity-centric society 11

About the authors 12

BT as your security partner 12

References 13

Contents

Executive summary

The need for more careful identity management is an inevitable

outcome of a variety of changes that are compounding together into

a perfect storm of change. These changes are making today’s world

increasingly dependant on digital identities to enable transactions,

allow access to services, information sources, communication

networks, applications, and even to enter buildings. As a result,

the volume of data and personal information that is stored and

harvested is growing rapidly, with personal information required

for every aspect of our lives from home, work, healthcare and

government. In addition to the significant user advantages and

cost efficiencies from effective identity management (IdM), the

increasing use of digital media and the web can also make personal

information more easily accessible, placing our privacy and security

as well as the resultant inappropriate exploitation of our identity at

serious risk.

Compromising an identity is the modern equivalent of holding the

“key’s to the kingdom.” Our identities underpin numerous critical

transactions and life events; once an identity is captured it can

quickly unravel into many unintended and damaging consequences,

reflecting its many uses.

Identity theft can happen to anyone. Statistics from the Home Office

in the UK indicate that identity theft affects at least one in four

adults, and the UK’s Credit Industry Fraud Avoidance Scheme (CIFAS)

reported a 17% increase in identity fraud in the past year. In the US,

The Identity Theft Resource Center reports that 19 people become

a victim of this crime every minute, with 10 million people affected

each year.

Business is becoming more successful at detecting fraud early

and stopping criminals in their tracks, according to recent figures

released by CIFAS, but identity fraud and theft are still a major

threat. Despite efforts to fight this crime, business, governments

and individuals are still not adequately geared to cope with the

consequences of identity theft, according to research conducted by

BT and HP Labs with the University of Plymouth, and published as

the Trustguide.

Research in the US, by the Ponemon Institute, shows that a lack of

accountability and resources are at the root of the corporate data

loss problem. Therefore, organisations need to guarantee effective

risk management and provide maximum protection to mitigate

the threats. Certain sectors are also under market and regulatory

pressure to provide tactical solutions, such as the deployment

of strong authentication, but this is expensive and needs to be

set within complex longer-term social, business and economic

dimensions, such as public trust, and technologies that are accessible

to all. Balancing risk and cost is therefore compounded by the need

to provide a diverse base of users with solutions appropriate for their

intended purpose, but still providing easy and convenient access to

services. Achieving the perfect balance is further challenged by the

need for organisations to maintain pace with the rapidly advancing

technology landscape and increasingly sophisticated identity threats

within a framework of legislative constraints.

Business costs to the organisation

The cost of inadequate identity management

Over the last three years, identity theft and crime cost the UK

economy at least Ð'Ј1.7 billion, according to the Home Office. This

amount