Identity Management
The need of the hour
Well, who do you think you are? What makes you different from the rest of the earthlings? I would have liked to answer this question with a cliché like, “I am unique because there’s only one like me”. However, science goes by facts and evidences (meh). Hence, identification in a technological context, is to spot an individual by making use of something that is unique to him or her.
This identification is then used to secure any process that he or she carries out by authenticating him or her in advance.
What are the accepted identifiers?
a) What you know
This is the most common identification technique in use today. With most of us owning more that one mail Id and access to a galaxy of other applications, I am sure you wouldn’t want to share your customized content of these apps even with your soulmate. This is where your passwords come into play. You are the owner of a password that ideally only you are aware of. The best part is you do not misplace it under the couch and it’s very user-friendly considering that you would have opted for a one that you would most likely remember.
However, the downside of this blessing is that if another person gets to know it, he or she might be in for a treat. To make things worse, a huge population uses the same password for all crucial applications. As easy as it might be for you to remember it, this is going to help your hacker or the lucky one who just went to being clever from being trustworthy, to log in to all your applications effortlessly. An application can only help you set a strong password so that it is harder to guess or crack and insist you to change it every once in a while. Keeping it safe thereon is every user’s responsibility.
b) What you have
This indicates any possession of yours that is accepted to be unique on a community, national or international level. This could be your university access card, national identity card or your passport. Where needed access, we should be able to provide the respective authorities with the physical evidence. This is a challenge to our inherent nature to be forgetful. Moreover, the costs associated with producing and replacing these are not very appealing either. In case of thefts, depending on the accessible domains, you might have to take immediate actions. Imagine your credit card being stolen. Frightening right?.
c) What you are
This is the most secure way to identify an individual. Here, we validate a person’s identification by using his or her biological data, i.e., the biometrics. Since this is neither snatched away from you nor tedious to carry, and is consistent, this is preferred in any area that needs extreme security. We should choose the right attribute to use as the identifier. Any attribute that might change frequently, be a threat to the human or have replications is a big NO.
This mechanism however, comes at a price, literally, with most of the biometric analysis systems being very expensive.
The type and degree of security we seek depends on the requirement and the sensitivity of the accessed field. However, with identity security breaches becoming more common everyday and compliances like GDPR fighting with and for the application makers and users like never before, we should make sure that we are aware of what we can do to avoid a third party interference in our security systems and make it stronger for our own good.
Security systems being handled solely by jargons is a thing of the past. People around the world create applications for every need of yours.
These applications need a secure but simple way to protect all that user data they collect for their operations in a responsible manner. WSO2 Identity Server is an open source identity and access management system that does exactly this and a lot more.
