Source: Liberty Alliance
The Liberty Alliance Project, a global consortium for open identity standards and identity-based Web services, today announced the formation of a cross-organizational group focused exclusively on curbing misuse of identity information.
The group is designed to serve as a hub for the global effort against identity theft, attacking these issues from multiple fronts in a collaborative, open and vendor-neutral environment. With leading technology vendors, government agencies and consumer-facing organizations among its members, the Liberty Alliance has the unique range of educational resources and technical expertise to effectively tackle identity theft's complexity.
Identity theft has scared away many businesses and consumers from conducting business on the Internet, and threatens to destroy many of the new lines of ecommerce. "Nine percent of US online consumers - or an estimated 6 million online households - have experienced identity theft. Only 21% of these consumers think their credit cards are secure online," noted Kate Delhagen, principal analyst in Forrester Research's Retail Group. "Because of this security skepticism, retailers must go above and beyond the normal security practices to build trust and increase their interest in purchasing online.*"
From its inception, Liberty has worked to make the Internet a safe, trusted and reliable environment for online transactions, and the rise in identity-related crime directly threatens not only Liberty's mission, but the growth of the Internet as well. The new identity theft prevention group will tackle this seemingly overwhelming problem the way it has always approached developing standards and guidelines: by working with relevant and leading organizations to define and dissect the problem from a market standpoint, and then developing solutions, be they technical specifications, policy best practices or business guidelines. Liberty believes that only a collaborative, multi-faceted effort can truly make progress toward solving the rampant misuse of identity information.
"You can't tackle what you don't understand," said Michael Barrett, vice president, Security Strategy and Architecture for American Express Co., former president of Liberty Alliance and current co-chair of Liberty's Identity Theft Prevention Group. "The first step in solving any difficult problem is defining and establishing the scope of the issue. Our team is working on this now, analyzing this problem from every angle and painting a clear picture of what we are up against. From this, we'll be able to provide a comprehensive view of the issues and threats, recognize behaviors that put organizations and consumers at risk, and present specific guidance on avoiding these actions."
The Liberty Alliance is made up of over 150 organizations from across the globe - ranging from educational institutions and government organizations, to service providers and financial institutions, to technology firms and wireless providers. Over 40 Liberty member organizations are currently participating in this group's activities - including representatives from Liberty's management board and all of Liberty's Expert Groups. The group is co-chaired by Barrett and Alex Popowycz, member of the Liberty Alliance management board and vice president for Fidelity Investments.
"A problem as big as identity theft needs an organization as big as the Liberty Alliance to solve it," said George Goodman, president of the Liberty Alliance management board and director, Platform Virtualization Lab, Intel. "Identity-related crime is a problem that spans many industries, technologies and markets across the globe. The only way to effectively tackle this problem is through an organization that represents multiple industries, technologists and consumer advocates across the globe. It also requires an organization that knows how to partner with others and collaborate to combat far-reaching issues such as online identity theft and fraud."
Attacking Identity Theft With Education
Technology, by itself, is not enough to solve this problem. The most powerful identity management technologies can still be hacked if users and businesses are not taking the appropriate precautions in protecting their information. The only truly effective solution is a balanced approach of technology solutions and strong policy practices, as well as an educated public. Liberty's goal is to work with its partners to introduce best practices (both technological as well as policy) and educate consumers and businesses, providing them with the tools they need to make informed decisions.
Attacking Identity Theft With Technology
Liberty's guidelines and standards have been developed based on the principle that consumers should have choice and control over what personal information they share and who sees it. However, online identities are difficult to manage because there are so many of them. Most users have multiple online user names and passwords (e.g., email account, instant messenger account).
The Liberty Alliance has already published numerous guidelines on identity-related issues and has developed technology standards that are widely adopted, with approximately 400 million Liberty-enabled identities or clients anticipated globally by the end of 2005. These identities, when used in a federated environment that follows the Liberty standards and guidelines, can already solve many of the technological challenges related to identity theft.
A federated network identity delivers the benefit of simplified sign-on to users by allowing users to "link" elements of their identity between accounts without centrally storing all of their personal information. This increases security and delivers better identity control. With a federated network identity approach, users authenticate once and still retain complete control over how their personal information and preferences are used by the service providers, regardless of the device or network access method.
Federation offers businesses, governments, employees and consumers a more convenient and secure way to control identity information. These organizations can already solve many of the technological challenges related to identity theft by using federated identity systems that follow the Liberty technical standards and implementation guidelines.
Attacking Identity Theft With Collaboration
In the spirit of collaborative activity, Liberty will host its first Identity Theft Workshop on July 20, 2005 in Chicago. This workshop will bring together several organizations that are working on various identity theft issues to analyze some of the most pressing online identity theft problems organizations and consumers are facing every day. A thorough analysis of an identity theft attack vector matrix, in addition to proposed mitigations, will be conducted, with the goal of producing a definitive document that reflects the knowledge and experience of all of the groups in attendance. The workshop will have representatives from government agencies, consumer groups and industry. This is the first of many collaborative activities planned by Liberty.