Digital Fingerprinting is an essential part of authentication!

The Wall Street Journal headlines last week announced the Race Is On to 'Fingerprint' Phones, PCs. Device fingerprinting is a powerful emerging tool in internet security trade, and LiveEnsure™ is leading the way with its SaaS authentication offering for web and mobile.

It might seem that one computer is pretty much like any other. Far from it: Each has a different clock setting, different fonts, different software and many other characteristics that make it unique. So it makes perfect sense to uses Digimetric™ technology to uniquely identify computers, cellphones and other devices, without building and sharing profiles of the people who use them.

I can't understand why more websites and apps are not more rapidly embracing digital device fingerprinting technology for authentication. It adds an altogether new layer of security for the user, the site and the session. The "fingerprinting" data is challenged "outside" the browser, its data is *not* shared, and the process is session/commerce context specific, i.e. purpose-built keys - the "smarter" and "safer" version of a universal fingerprint. This architecture is based on years of study - finding that trusting purely general-built keys is great for convenience but not worthy for security.

LiveEnsure™ sits in the gap - providing strong, real-time authentication, using a universally unique digital footprint of a laptop, ipad, device or smartphone. There is nothing for the user to download, install and no out of band/dongle/token to look after. The login process is seamless the clever device recognition happens without the user being aware, checking the device fingerprint in real time as part of a secure triangulation.

Low price high strength, developers can mash up today at http://www.liveensure.com/

Identity Management and The Law

In online identity management and authentication there has been significant work related to the technical exchange of identity information and the actual authentication processes.

This is the cutting edge of a new area of law that is starting to get real attention. Identity Authentication.

“It varies by jurisdiction but there’s a fair amount of privacy law, particularly in the European Union, but to a lesser extent in the U.S. financial and health care sectors,” Smedinghoff says.

Case law starting is starting to ramp up...

In situations regarding identity theft, case law is beginning to emerge. Courts are starting to point the finger at businesses that did not, in their opinion, do enough to protect personal information. Businesses need to be sure to meet obligations and properly authenticate or identify individuals and make sure not to release personal or confidential information.

If a business is the identity provider within the management process, then they are making assertions about a subject to a third party or a relying party. These assertions can, in theory, be considered warranties or representations.

This is good news for online users, with new 'mashup' technologies and cloud solutions entering the market place it is simpler for website owners to secure their users with technologies like LiveEnsure™ multifactor authentication.(http://www.liveensure.com/). Consumers need to trust that online portals are protecting them to do business, the law is highlighting the need for businesses to set us security systems that do this.


Full Article:
http://www.secureidnews.com/2010/06/01/identity-management-and-the-law

Online Fraud Protection requires a layered approach.

Identity Management Requires Defense in Depth, Much Like Enterprise Security

I could not agree more with Scott Waddell's blog entry on depth of security. It’s only a matter of time before today super powered cyber criminals find ways to take advantage of the inherent weaknesses in even the best technologies, '2 factor' have been hacked, username and password is not enough... you can google for yourself the stories.

Today’s cyber criminals are so tech savvy and innovative that staying one step ahead of them isn’t always possible. So when it comes to network security, a good defense should be made up of several different layers. That way, even if a hacker is able to exploit vulnerability in one layer of the system, he may be stopped or slowed down by another. This strategy, known as defense in depth, essentially allows organizations to protect the integrity of their systems by slowing hackers down and buying security professionals the time they need to respond to a security breach once it has occurred. This mitigates the damage that malicious hackers can do, even if they are able to make it past initial barriers.

The same basic principle of creating a more comprehensive defense by layering tools and diversifying methods can be applied to fighting online fraud. To successfully combat online fraud, a fraud management system should include the layers of defence including multi-factor identity authentication.

I agree wholehearteldy with Scott that the best offensive against cyber crime today is a multi-layered defense.

http://blog.iovation.com/2010/02/19/fraud-management-requires-defense-in-depth/#more-1580