European Identity & Cloud Conference 2018

Learn all you need to know about the future of information security today!

An Expert Stage presentation at the European Identity and Cloud Conference 2018

An Expert Stage presentation at the European Identity and Cloud Conference 2018

An interview during the European Identity & Cloud Conference 2018

Privileged accounts, credentials and secrets are everywhere— on premises, in the cloud, on endpoints, and across DevOps environments. From personally identifiable customer information to critical intellectual property, they provide access to your enterprise’s most valuable assets. And attackers are after them. Right now.

As one of the winning presentations from the pre-conference Blockchain ID Innovation Night, Dr. Torsten Lodderstedt will continue his presentation about the limits of Blockchain Identity and the challenges that still need to be solved.

In a world where everyone has a large amount of different personas and credentials stored and managed by government, banks, socials and other, we call for consolidation and control while preserving privacy and security. With DLT a lot of that call can be answered, but how do we roll-out. There are some major challenges to adoption such as usability, network economics, governance, privacy and recoverability. How do we approach these challenges to reach a global self-sovereign identity platform?

Around the world topics related to Digital Identity are becoming more and more critical. The world is beginning to recognize that Digital Identity lays the foundation needed for trust to perform myriad transactions in both the public and private sectors. Canada is moving rapidly toward the next Digital Identity Revolution. In this new model, capabilities from both the public and private sectors come together to deliver value to businesses, customers, citizens, and governments.

This Digital Economy focused model prioritizes privacy and security by design as well as convenience delivered through user-centred design. Solving for Digital Identity that secures Canada's participation in the Digital Economy requires the significant and sustained efforts of experts and influencers from every sector. To ensure that business, legal, and technical decisions makers across Canada are well informed, DIACC has taken a closer look at the economics of Digital Identity. In this presentation DIACC will share our findings with the world.

British Columbia is a digital identity leader in Canada with the development of the BC Services Card and associated digital identity services. Building upon our experience in providing digital identity services for all British Columbians, the Province of BC is now collaborating with the Canadian Federal government and the Province of Ontario in establishing the Org Book for businesses. The Org Book provides verified digital claims about businesses and their representatives to enable streamlined government service delivery to businesses and to enable digital transactions in the broader economy. Imagine a new business owner incorporating their business, establishing business licenses and permits, and opening banks accounts in a seamless and secure manner using mobile and distributed identity blockchain technology.

Some of the most common causes of cloud security breaches include system misconfiguration, dynamic system updating and patching, unmanaged and leaked access credentials. The industry is applying different methods to overcome these challenges. These methods include dynamic system monitoring and alerting, automated deployment pipelines, and access management including credential and key management and rotation. But what if we could overcome all of these challenges with an immutable cloud infrastructure that could be accessed without any credentials which could be leaked or compromised?

In recent times, an increasing number of vendors announced a migration of their products towards microservices architectures. Some renovate their existing on premises IAM tools, others build new solutions with a new architectural approach. Factually, the idea isn’t that new, but the evolution in the field of microservices and containerization now enables flexible architectures that allow to distribute and scale components better than in the past. Furthermore, such architectures build the foundation for simplified hybrid cloud deployments, but also increased customization using APIs exposed by these microservices

GDPR obligates organizations to provide data subjects with access to their personal data. To comply, companies must be able to answer a seemingly innocuous but frighteningly difficult question: What do we know about the data subject? Further, organizations must respond to Data Subject Access Requests (DSARs) in a privacy-preserving, Privacy by Design-embedded manner. This is going to be problem as organizations are not going to be able to reliably find the data – as there are too many places look, data variability (Elizabeth vs. Liz) and other problems. In this keynote these identity challenges will be explored and remedies will be suggested.

IAM products are highly configurable systems tailored to the diverse needs of customer environments and applications. Modern applications require short development cycles and IAM systems that can be adjusted at the same pace. Modern data centers are configuration-driven, resilient environments designed to meet rapidly changing application needs, and modern IAM solutions must be in line with this paradigm.

Introducing traditional IAM products into cloud containers is not a simple "lift and shift" operation, as it once was with the virtual machine infrastructure. Today's micro-service-enabled, service-mesh-oriented infrastructure expects simple, resilient, self-discovery services instead of brittle monoliths that rely on manual configuration.

Operating IAM products with a DevOps setting in terms of automation, repeatability, and continuous improvement is possible through close collaboration between IAM, application, and infrastructure experts.

Social, economic and technological changes are creating urgent new requirements for enterprise identity that enable interconnected digital systems. These new use cases require a governance framework that is consistent, integrated and efficiently managed. It also needs to provide increased security, privacy and reliability while being open. Learn how to respond holistically to these growing and evolving identity needs.

Although companies are constantly increasing their cybersecurity budgets, this does not seem to help much: each day we learn about new large-scale data breaches. Considering that over 80% of hacking-related breaches leverage compromised user credentials, it’s mindboggling why so many organizations are still focusing on securing their network perimeters.

This keynote outlines an entirely new approach — Zero Trust Security. This paradigm assumes that nothing in your corporate IT infrastructure — including users, endpoints, networks, and resources — is ever trusted, and each interaction must be verified to decrease the chance of a security breach. Zero Trust Security ensures secure access to resources while significantly reducing the possibility of access by bad actors.

The focus of digital identity for consumers and enterprise is to remove silos, minimize redundant effort, enable better collaboration and provide a foundation for regulatory compliance. The challenge is that shared credentials for both commercial and public-sector organizations will require organizations to innovate to address requirements for physical access, protecting PII, delivering cross-agency services and re-thinking how digital consumers interact. In this session, we will discuss best practices across the industry that can be applied to enable interoperable credentials, we will explore architectural practices to manage identity assurance levels, and identity verification for both logical and physical access.

The real problem behind the recent Facebook scandal is not primarily that a company like Cambridge Analytica has "gained" access to the personal information of millions of Facebook users and misused them for political manipulation. It is the business model of social networks itself: Letting their users deal privacy for some kind of communication convenience, without letting them at any point opt for both: the convenience of using social network services to digitally interact with others as well as control over the usage of their personal information. 

Will such business models survive? Is privacy a disclaimable option or is it a constituent element of our personality? 

European Identity & Cloud Awards Ceremony

Distributed Ledger Technologies ("Blockchain") are the foundation for the most disruptive changes to business we are either already observing or that are on the road to becoming a reality. Based on these technologies, both new business models and fundamental changes to established models become possible – and what is technically feasible and economical beneficial will happen.

However, there is still one missing element for fully leveraging the Blockchain potential: Identity. Identity in that context is far more than just identification, authentication, or authorization. It is about linking people, transactions, and digital assets. It is about managing properties, rights, agreements, and contracts – linked to persistent, reliable identities. This is where Blockchain ID comes into play, because it is the only way to enable many of the business scenarios of tomorrow. There is still some way to go for Blockchain ID, starting from making it more than an ID for identification, authentication, or authorization.

Blockchain is much more than the technology behind its still most successful application – the Bitcoin. One of its key attributes is the immutable storage of information. Besides other applications, this enables trustful online business between two or more individuals – without the need of any intermediary. Thus, the Blockchain is said to introduce the “Internet of Trust” as successor of the “Internet of Information”. In various workshops with industry, we have identified how organizations cope with this possibly disruptive technology. While some try to identify threats to their existing business models, others seek opportunities for new business. Generalizing from the many ideas, we identified several design patterns for use cases that are expected to be successful within the next years. In my talk, I will shortly present an overview of the fundamental Blockchain principles, and the identified use case design patterns.

We will Disrupt You - Are AI, Blockchain, IoT a Blessing or Curse for an Insurance Company?

ABNAMRO runs over 30 blockchain experiments, also involving digital identity capabilities. Co-operation has been set –up across various coalitions, and use cases are running a lot wider than just the banking and payments industry. Academia, building-, and shipping industries are also involved. What are the typical problems to solve with blockchain technology, and why? Some of the practical use cases and scenarios ABNAMRO is involved in today.

Nearly all advice on GDPR compliance is about what companies can do for other companies, or companies can do for themselves. There isn't much on what customers can do for companies, which may turn out to be the biggest help of all. That’s because customers are going to get more power all the time, and that’s exactly what the GDPR was made to encourage, whether regulators knew that or not. Doc Searls has been on this case for over a decade, leading ProjectVRM, which encourages development of tools and services that empower customers. (And which won a KuppingerCole award in 2008.) Doc will talk about how the best of those new tools will open easy and low-cost paths to corporate compliance with both the GDPR and ePrivacy regulations, while opening new market frontiers as well.

Keynote at the European Identity & Cloud Conference 2018

In this session, we will introduce a framework to establish digital trust based on capabilities from fraud protection and Identity. This will quickly and transparently establish a trusted, frictionless digital relationship for your customers, employees, and business partners. The session will also highlight key scenarios of adoption, best practices and leveraging emerging topics like decentralized identity networks.

The AI and Robotic Process Automation revolutions are in full swing with record growth in both sectors as well as an explosion of new startups in this space. Not to be left behind, existing vendors are rushing to heed the call of AI and automation by sprucing up there existing product suites with conversational interfaces and smart AI-driven assistants. This session will cover the impact of these emerging technologies on the IAM product space and what can be expected in the near future.

Customer Experience is Everything and Everything is Digital. Digital transformation is now the center of marketing, advertising and sales strategy across every industry and region, with today’s consumers demanding a seamless and relevant experience across online and offline channels and devices.

Consumers and Regulators Demand Privacy, Security and Control of Personal Data With the rise of increasingly severe cybersecurity incidents and concerns over poor or unethical business practices, governments and their citizens are rewriting the rules for online commerce and the collection and management of consumers’ personal data.

Enter Customer Identity management to bridge the gap between customer experience and consumer privacy.

It takes most businesses over 6 months to detect a breach on their network. And while smoke detectors are proven to halve the death rate by fire, saving thousands of lives each year, detection is sometimes too late to prevent many buildings from burning to the ground.

So imagine if it were possible to reduce the risk of a cyber-security fire starting in the first place. We are all familiar with the elements needed to start a fire: heat, oxygen and fuel. For data breaches, one key element of risk is abnormally high access entitlements. Detecting these abnormalities early, across your enterprise, enables you to remove them entirely from the equation. Couple this insight with sophisticated smoke detection equipment and you have an increased chance of limiting the damage wrought by any fire to your business.

In this keynote, we will talk about the importance of fire prevention in your enterprise and how, through the use of identity analytics and User and Entity Behavior Analytics (UEBA), you can install the perfect fire prevention and fire detection tools to get fire safety right.

Identity is as old as mankind and adapted very well to its changing environments. From a simple look that determines who you are to a high frequency of multi-factor vehicle-to-vehicle authentication in autonomous driving - with Digital Transformation, Identity in digital form has become the enabler of complex horizontal value chains and ecosystems. Without authentication, authorization, and consent, those digital ecosystems of our every-day journeys will be less secure, less convenient, and less beneficial. The “consent" part most especially needs new thinking - from pure protectionism to enabling benefits for both individuals and service providers.

Trust is essential for a society to function. It’s even more critical in a digital society where transactions take place between parties that can only rely on each other supplied digital Identity.

eIDAS Regulation provides – for the first time – a clear, universal and comprehensive Trust framework for the digital world. Thanks to eIdas, EU is today the country with the most advanced regulatory framework for Digital Trust but, the Regulation is not able to cope with the new challenges introduced by AI, IoT or Distributed Ledger Technologies. Software increasing pervasiveness in our society is creating new paradigms that will redefine the concept of Trust and the ways it can be enforced.

Digital identity solutions are very wide spread and everybody is using them on a day to day basis. Mainly it can be distinguished between state issued IDs/eIDs which lack usability and are therefore not as successful as hoped and self-claimed or self-established eIDs (sometimes stored in the blockchain) where service providers have to rely on the honesty of the user. Additionally, self-claimed solutions mostly focus on the eID and don’t cover traditional ID documents. In this presentation, a mobile ID solution is presented that shows a combination of traditional printed ID documents and electronic identities (eID) into a multi-platform smartphone app that is recognized by the government. It’s an ID/eID scheme for transparent identification and authentication in the physical and digital world while security, privacy, data protection, usability and user trust are at equilibrium. Security is built upon secure processes rather than hardware (like secure elements), thus providing the fundament for broad adoption including technically challenged people. Scalable architecture, standard future-proven technologies like OpenID Connect, FIDO authentication and eIDAS compatibility build the framework for secure, failsafe and large deployments.

Identity and Access Management (IAM) within an enterprise environment presents complex challenges for any business. While new technologies, such as blockchain, have the potential to help solve some of these challenges, today bringing blockchain into solution oriented discussions can merely add to that complexity. In this session we’ll explore the pillars of blockchain based identity, and how business can use blockchain as a keystone technology to simplify many of the traditional challenges of IAM.

The future of IT security will depend on CISOs who are brave enough to build a new security model that is both innovative and unconventional. Gas distribution company, SGN, is blazing a trail that every company can follow. As a UK, critical infrastructure company SGN’s cloud-first strategy, provided an opportunity to redefine the security model with privileged access zero-touch and zero-trust as key principles. This thinking is enabling secure adoption of the cloud, IoT and frictionless user experience. The result is redefining traditional thinking.