Event Recording

Closing Keynote

Name: Closing Keynote
Uploaded: 2023-05-12T12:00:00+02:00
Duration: 24 min 57 s
Description: This video has no description

Posted on May 12, 2023

Speakers

Research Analyst
KuppingerCole

Marina Iantorno

Marina joined KuppingerCole as a Research Analyst in April 2022. Her main areas of expertise are Business, Data Analytics and Artificial Intelligence. Background & Education Marina holds a Bachelor degree in Marketing from Argentinian Business School (Argentina), an MBA from Valencian...

View profile

Principal Analyst
KuppingerCole

Martin Kuppinger

Martin Kuppinger is Founder and Principal Analyst at KuppingerCole, a leading analyst company for identity focused information security, both in classical and in cloud environments. Prior to KuppingerCole, Martin wrote more than 50 IT-related books and is known as a widely-read columnist...

View profile

Show Transcript

Thanks so much for being until this time here with us at the eac. We were really pleasure to have you and to have these great speakers with us. I would like to give at this time a special thanks to our sponsors. Without our sponsors and without our partners, this great EAC would not have been possible. So thank you so much. I would like to thank to all the moderators who did a great job introducing the speakers and welcoming you in all the sessions. Thanks to all the speakers, those who were here, those who were online. I know that in some cases we had the speakers who had the time difference, you know, and they log in at four in the morning or, or at 11 in the night. So thank you so much for that. Thanks to Audi Luma, our technical team, they, they've done a fantastic job and they took care of us and of all the speakers and thank you so much as well for the team here from the bcc. It is our second time in Berlin and we are actually pleasured and I'm very grateful for all your help and well, so we know further say we would like to show you a video with the highlights of the eac and I am sure that most of you already know like the best positive things about this event. But I let you with the video and I come back in a moment.
I am here for everything about digital identity authentication,
But more specifically about digital wallets, verifiable credentials and communication and establishing trusted relationships.
And then yeah, government. I will say in general,
First, Neal very interested into AI and all the deep learning, which has been going on now as well. It's very much of a trend.
I'm super interested in digital wallets. What's going on? Basically go, it's about the people. It's
Quite exciting. Lot of topics being around that area.
The first piece around chat g PT was fantastic, actually. Really, really great presenter. The,
I know about the Open Waller foundation, I really
Actually like the open sections
And in general, all topics that relate to ethics, biases in identity management.
And there are several super interesting sessions about how we can use verifiable credentials in the future within the European AI regulation
Topics that are useful even if you're not here for the mechanics. So identity platforms,
Infrastructure security platforms with the key highlights. I would say
It's very well organized,
Thought-provoking,
I would say
Good networking
Located in a very good place,
Innovative
Universe for cyber geeks.
Speaker 10 00:03:51 Super excited to have all in one place.
I will recommend that confidence to any of my colleagues.
It's a place to be really need to be at this conference. It's a must path for your calendar every year.
It's
Really a great one-way program to make the asper in the industries
Because these are the tech experts and I think there needs to be more exchange on ideas on these topics.
I'm really happy to come here next year as well and can recommend it. Certainly.
Definitely. I think it's a good platform to collaborate together and understand what's going on.
It's a good place to catch up on what's going on and to meet new people. So I think I'll be back.
Thank you so much. Well, the last thing that I would like to mention before bringing our principal Analyst to the stage is that the gamification winners will receive an email on Monday. So with no further say, let me bring back to the stage Martin. Kuppinger.
Speaker 12 00:05:20 Thank you Marina, thank you to all that have been here or have joined in virtually. It was a intense week. I've learned a lot before. I talk a bit about some of the, the bigger learnings. I wanted to extend the thank you on one hand to my fellow analysts, which did an exceptional chop in their presentations and their moderations. And specifically last, not least to our events team who works a full year hard on making this event what it is. So thank you very much. Thank you very much Betina, and thank you very much to all of the team. So as usual, I will wrap up some of the things I've seen. So focusing a bit on three trends, and I think the good news this year is my, my train is departing at 5 0 4. I'll need 30 minutes probably to the railway station, so it gives us two full hours for the wrap up. Isn't that great?
Speaker 12 00:06:34 No worries, no worries. I, I won't do two hours. I will keep it shorter. So three, three themes I, I'll, I'll like to talk about the one is AI and I am and beyond or AI and digital identity and beyond. The second is authorization policies, et cetera. And the third one is wallets, decentralized identity, ssi, d i d, verified credentials, verifiable credentials, et cetera. But by the way, this already illustrates a bit of the problem, different names for sometimes the same or different things and I think also very different perspectives on how to make this work. One, one of the important takeaways for me around this is there's a huge potential for doing a lot of things based on, I call it decentralized identity. And we can make it work. It's most, is there some things will come like open wallet foundation. I today even had a talk with someone who said, we already will know what we will contribute in code.
Speaker 12 00:07:52 We will be the first one. They said, I hope that a lot of will contribute code to make this work. But I think the most important thing around that is to think from the user, to think from a perspective where a citizen is a customer of the government and not the government tells the people how they have to act and so don't create roadblocks. I think the cool thing is here at this conference, the people who are here want to make it work. I have to say if you go physically a bit around here, then you surely will find some more who think a bit in roadblocks making complex. You know, honestly, I use my phone regularly for financial transactions. Eric asked a question, he said, you know, how, how frequently do you interact with your government a few times a year. How frequently do you interact with others?
Speaker 12 00:09:03 Many, many times a day. And we have a lot of use cases also a lot of use cases which have some risk involved where we feel confident with that. We have secure elements on the phone, we know how to create apps that are secure. We, we know a lot about this thing. So honestly, I say what is the maximum level of of inconvenience I would accept for very few high risk use cases, it would be taking my e i d card, putting it here, having NFC saying, okay, Martin really has that card and going through verification process that says, okay, this is Martin, this is the proof for Martin. Going through that exactly once, no extra pins, no extra hardware, nothing that all are roadblocks and that is the stone age of it. So people who bring up these ideas have probably missed a couple of years here.
Speaker 12 00:10:05 We must not make security a roadblock because we can do a lot of security sensitive things here. And this is the way of thinking we must bring forward. We have the tools, we can get enough security and there's never 100% security and most of the use cases work. And notably even even voting, you know, if my phone is hacked and my board is faked as one of 80 million Germans, what is the statistical impact of that? And hacking 10 million phones would be a big issue to solve. So, so even there, we need to be a realistic MR risk and to be realistic about what we can achieve. So don't make it more complicated than it is needed. Make it work. Leverage the potential we have here. And I think this, we had so many cool talks, so many good talks about it, so many good ideas. Let's continue working on that because this is a, a huge potential for, and we had these talks doing a lot of things we can't do well yet. Like I'm a German, like a digital government, so I I I trust brought up my, my e i d card by the way, the German one, which has some digital functions as I believe.
Speaker 12 00:11:32 Do I use them? No, I not even know exactly what I could use. And it's me. I, I have a bit, bit of a knowledge around digital identities on these things, but it's so complicated and so useless in the way it's made that we must not repeat the same mistakes. We must make it work global. Very important, you know, a dig a wallet, which I can use within the U, but not for a digital transaction with someone in the us What is the value of it? I would say I can define a number for it, which is exactly zero. Exactly. Only if we think global and think from the customer, from the user, we will win and we can make this, we have to think in hand, we can make it work and we should work hard on that to make it work. And we also talked about it also can make a lot of things better in the enterprises onboarding of people, authorization, all these things.
Speaker 12 00:12:41 So you, you've, you've, you see, I, I get a bit emotional on this object, but, but it's, it's to my heart, you know, I want to make this, yeah, make these things work and we can do it. We should do it. And I think we had a lot of discussions which hopefully help to move things forward, including the announcement of the open wallet foundation, which is definitely one of the elements that can be very valuable in driving this forward. So coming toward the second topic where I'm also a bit emotional, but not as emotional as in, as in the first one, authorization I already touched. We can do a lot of things better with proofs, wallets, decentralized identity. We can't use policies, look at proofs and say, okay, Martin has to prove that he's Martin at Analyst, the principal Analyst working this project at that customer.
Speaker 12 00:13:41 We can authorize him for project data without static entitlements and all that stuff. So there's a potential, the thing I always find a bit funny is, so there, there was, was a thing announced or released in 1976, a software product, which is, which was I, which is IBM rf. So we, we must not say that the idea of policy-based authorizations is new, 90 76, that's 47 years. And yes, you can argue, oh, that was in the mainframe and the mainframe is that, isn't that on one hand. And it was, yes, it was a bit more limited environment, et cetera, et cetera. It was surely not perfect from our ideas of policy based association, but it's not new. So maybe after 47, 47 years, it's time to make really a big step forward with that. And I saw a lot of conversations that were around, we talked a lot about authentication. We also, he talked a lot about authentication and yes, there was a lot of talk about task keys in the last months, et cetera. But it's, I think time to, to expand our focus towards authorization and to make things work better. And there's a, again, there's a lot there. There's a lot we can do. There's a lot of technology there. And we, we should move forward here because, and I I talked about this in the morning.
Speaker 12 00:15:25 Role modeling projects tend to be complex, lengthy, and have a slight risk of stalling at a certain point. And recertification definitely doesn't count amongst the favorite tasks of departmental managers. So we need to overcome this, we need to do certain things better. And yes, there are the audits and the auditors saying, oh, you must prove that you're following the least privileged principle, but has, it may, it may exist in a certain country, but has anyone of you ever read in a regulation, you must walk your departmental managers through recertification campaigns where they need to approve entitlements where they don't have any clue what they are about. Is there any regulation saying you should do it that way and push it rubber stamping, which doesn't help with security, but only in compliance. So security is something different than passing an audit. And passing audit is something different than compliance.
Speaker 12 00:16:41 No, there is no research regulation. The regulation says, yeah, reduce risk in further least privileged principle, this is what regulations are talking about. Surely auditors then also need to change a bit what they are looking for. But I think the interesting point is, I had a couple of talks with a couple of auditors, frequently very high ranked people in the audit firms and they all appeared to be open regarding accepting different approaches. So it's not that this is the always the province, some told me, oh, but the auditors, no auditors tend, you not always observed it, but they usually are very smart people and they are open to good ideas. That's my experience. And so don't, don't, don't say, oh, but the auditor because it's also creating a roadblock artificially get rid of this in a way and say, Hey, we need to make things better and this is a call, call to everyone.
Speaker 12 00:17:51 So the short topic, I I, yes, that's it. I just thought about what it is, but, but my, my, my my, my avatar didn't respond quickly enough to my thought. So with the small block in the ear or so, yeah, so what I like is that I think the perception of, of half of AI is, is really increasingly not artificial, but augmenting AI or whichever term you use, something which helps us. And, and there's a huge potential in that. I had some very interesting panels around AI regulations, around AI governance, at least in these panels, there was a common sense that we must not go over the top, but we, that we need to, to understand where our risks, how to deal this risk and for which use cases we may need to, to have a bit of sort of a closer look at and some be a bit more careful and we're not, and I think we need to be, we must avoid again, creating roadblocks by, by hindering innovation. So saying, okay, the next six months we stop developing new stuff in ai.
Speaker 12 00:19:13 I I wouldn't rate it too high on my list of smartest ideas of the year, really. No, it's probably down there, not even here on the floor, but even further down on that list because that is not what we need. We need to, to, to come up with smart solutions. And I trusted a panel with Sylvia Ni or PWC and Scott David, where, where we talked about some, I think very, very good ideas, very good concepts to look at, very verse to listen to the recording. I believe you can always do a bit of fast forward when Scott starts talking because after five minutes he come will come to the point. He has been a lawyer, so it's a bit different. No, but he, he had some, some fantastic insights. And I laugh, I laugh Scott, Scott is doing great things. Sometimes the lawyer comes through repeat by words.
Speaker 12 00:20:15 Anyway, I, I think what we have is a, is a fantastic potential for me. The biggest potential honestly is not in coming up with better proposals for roles. The biggest potential is in augmenting. So we, we have mentioned frequency situation that end users, a lot of things end users where end users have touchpoint with identity or digital identity happen. Rarely. There are some things they do permanently like authenticating or looking camera or using finger. I'm, I'm old school, I use the fingerprint still most use more, more face recognition. But anyway, this is something which happens permanently. But other things like whatever, changing some attributes, requesting access, if we're not a policy based access happen rarely. So augmenting people in, walking them through how to do, do it, et cetera. So that could be something where, where we use AI to really augment people and to augment administrators.
Speaker 12 00:21:21 We have this skills gap thing in cybersecurity and digital identity. And this is definitely one area where conversational AI or chatty AI can help us in doing things better. And a sec we see more and more examples coming in the cybersecurity, in the broader cybersecurity space on how to walk through malware analysis et cetera by guided prompt books, et cetera that help to, to understand this. And I think this is a huge potential. And so we, we should, we must find a good balance here, but I think we, we clearly need to be also look at the bright side of it. So yes, there, there are things that can go wrong, there are things that will go wrong. We need to understand what we need to do here, but more importantly, there are a lot of things where AI can help us. It'll change a lot in for many, for for many types of work including our Analyst work.
Speaker 12 00:22:35 It'll change a lot but change and change, there's always little change means, okay, new things, but there's always an opportunity and I look at the opportunities of it and use what we can do with ai. And I think this is, this was a third very big scene. We had a ton of other topics we were talking about at DSE and I hope that all of you were able to to, yeah guys are some takeaways that help you in your daily Chopped already say, okay, this, this is a great idea, I need to think it through, but this could be something which really helps me. If you have some of these takeaways you take back home, then it is what we want to achieve to help you. So in, in that sense, E i C is a bit ai see in augmenting you in your work and that's what I hope you did and I hope you enjoy it that week and I hope that you will i'll that we will see you back.
Speaker 12 00:23:48 So it's time that I stop, so when I start mangling words, then it's latest time that I stop. So that's a good thing. It's not, not five or not four 30, but I already start mangling things. So I stop here, say, have a safe grip back. It was a pleasure having you here. Hope to see you in here again next year and have fun with digital identity in your chop over the next 12 months. And then we'll tell, all the speakers will tell you a lot of new things for the next 12 months. Safe travels and bye.
Thanks Martin, and again, thank you so much for staying with us until this point of the event. We are looking forward to meeting you next year and in our next event in Cyber Revolution. So thank you so much. Have a safe trip to home and we hope to see you again.
Speaker 12 00:24:56 Thank.

Playlist

European Identity and Cloud Conference 2023

Event Recording

Holistic SAP Governance through Enterprise Environment Integration

May 12, 2023

Vertical risk management and complete identity governance can only be achieved through integration of critical platforms with other systems and applications in use and by either integrating existing point-solutions or reducing their number altogether. Integration of the identity-platform with SAP is one of those major challenges for many organizations today.

One Identity’s approach to this challenge is through a unifying, standard integration into SAP as well as other systems and applications to establish a common GRC framework and security concept. Which includes preventing isolated environments. To establish SAP-internal governance and minimize risk within the platforms privilege landscape most organizations use specialized embedded tools like ECS (Easy Content Solution) from IBS-Schreiber Solution. Integrating the identity management platform with the SAP rule-set administration allows SAP Rule sets to be applied directly, run SoD-analysis fast and efficiently and extend them to other systems and applications, such as MS AD, AAD. The potential value of this approach is significant as it allows a preventive risk-assessment throughout the whole SAP-stack.

This integrative approach also extends to the SAP Firefighter concept for it to be applied to the rulesets and extend these into other systems. The objective is clear: Simplify risk assessment and management, establish a unified identity administration framework and as baseline - reduce cost.

In short – it lays the foundation and framework for solid Governance.

Watch

Event Recording

Street Cred: Increasing Trust in Passwordless Authentication

May 10, 2023

Good security gets out of the way of users while getting in the way of adversaries. Passwords fail on both accounts. Users feel the pain of adhering to complex password policies. Adversaries simply copy, break, or brute-force their way in. Why, then, have we spent decades with passwords as the primary factor for authentication?

The industry needs to trust passwordless authentication (FIDO2). Adversaries and then criminals have circumvented our authentication controls for decades. From the very first theft of cleartext passwords to the very latest bypass of a second-factor, time and again improvements in defenses are met with improved attacks.

What holds us back from getting rid of passwords? Trust. In this session, we will propose a framework of technical controls to ensure only trusted sessions authenticate, regardless of faults or failures in any one factor, and to reassess based on shared signals (CAEP). We will share a path forward for increasing trust in passwordless authentication.

Watch

Event Recording

Leveraging Decentralized Identity Approaches in the Enterprise

May 11, 2023

In this session, Martin Kuppinger, Principal Analyst at KuppingerCole Analysts look at the potential of utilizing DID approaches within the enterprise. This session will look at the business benefits, the steps involved, important considerations, challenges, pitfalls, and recommendations for implementing decentralized identity. Martin will explain the potential and look at how this will impact existing technologies such as IGA, PAM, and Access Management, and how this relates to other trends such as WfA, BYOD, Policy-based Access, and more. He also will outline where interoperability and standards must further evolve to enable organizations in re-inventing their IAM, without ripping everything apart. He will discuss the steps involved, important considerations, challenges, pitfalls, and recommendations for implementing decentralized identity in the enterprise.

Watch

Event Recording

Rethinking Cloud Access Management

May 11, 2023

We must secure our organization’s processes regardless of what tech they run on. Originally, security leaders had leverage. We controlled the horizontal. We controlled the vertical. And if people wanted to work, they needed to follow our rules to access corporate apps and services. But then came Cloud apps, and BYOD, and consumerization, pushing security beyond our outer limits. Security happens where psychology and technology intersect. The everyday decisions of employees increase or decrease an organization’s risk.

Employees don’t need us. And by employee, I mean more than end-users. This is a broader conversation; including software developers, IT engineers, DevOps practitioners, and more. To get people to opt in and follow secure practices, we turn to behavior science. IT security leaders must offer them a compelling experience. In this panel we will discuss how to carefully balance the need for security, compliance, and efficient resource management to ensure that your cloud environment is both secure and effective.

Watch

Event Recording

Real-time Fraud Detection - Challenges and Solutions

May 12, 2023

Fraud can be considerably reduced via speed, scalability, and stability. Investigating fraudulent activities, using fraud detection machine learning is crucial where decisions need to be made in microseconds, not seconds or even milliseconds. This becomes more challenging when things get demanding and scaling real-time fraud detection becomes a bottleneck. The talk will address these issues and provide solutions using the Hazelcast Open Source platform.

Watch

Event Recording

What’s Hot at the OpenID Foundation | Workshop

May 09, 2023

OpenID Foundation leaders and contributors will brief the EIC community on the latest progress and outlook for the OpenID Foundation. As part of this workshop we will cover:

The identity landscape
The Foundation’s 2023 strategy
New partnerships and liaisons
Headlines from the Foundation’s latest whitepapers on Government, Privacy and IoT
Briefs on Working Group and Community Group progress and outlook
Deep dives on key issues facing the community - for your input!

Please join us early to be part of the conversation. Workshop presenters include Nat Sakimura, Gail Hodges, Kristina Yasuda, Torsten Lodderstedt, Tim Cappalli and others.

Watch

Event Recording

A 4 Year Journey Towards a Smooth and Strong e-Signing Solution in a Multi-National Insurance Company

May 10, 2023

A journey of the multi-national insurance company to find and introduce a smooth corporate e-signing solution, both legally and technically well-justified. A story of considering and aligning different dimensions to find a tiny path between legal trust and protection, technical constraints, smooth user experience, global EU Regulation (eIDAS) and country-specific local habits.

It was a huge puzzle to identify and solve all the critical actual and future needs of the different business use cases for e-signing across the company to come up with a singe corporate solution and move gradually away from the very fragmented and mainly technically driven landscape of signing solutions.

Traditionally those have been introduced as the ad-hoc remedy to some local needs in isolation from other initiatives and without proper validation of both short and long term legal impact to the company.

Watch

Event Recording

Open Banking and Open Data - Global State of Play. Current Trends and Recent Developments

May 10, 2023

Open Banking is a true global movement that has already been implemented in many countries and being implemented in many others in the next few years. While the overall objective of Open Banking is the same, every implementation is different. This session will provide an overview of analysis of different ecosystems, different approaches to implementation, industry standards used, best (and worst) practices and potential future developments.

Identity and API security are key building blocks for any trust ecosystem supporting Open Banking. We will explore why every Open Data project becomes an identity initiative.

Watch

Event Recording

The Human Factor & Access Governance

May 11, 2023

One of the fundamental problems of identity and access governance lies in very unclear relationships between real business needs, access policies and decision making about allowing certain action on the assets. For years we are trying to develop access policies which at the same time corresponds to business expectations, digital security rules and regulations, and people-centric to minimize deviations.
In this session, we will discuss human factor in IGA program and how to provide human factor analytics in access governance using new three-dimensional model called NPR (need, policy and resolution). We will show how NPR reports will help the organization to determine necessary adjustments of the policies and their implementation in Identity Governance workflows and processes to improve maturity, decrease risk of breaches, policy deviations by users and cost of managing and enforcing policies also known as Costidity. We will also show the sample reports based on data from higher education customer.

Watch

Event Recording

Prompt Engineering for Identity Security Professionals | Workshop

May 09, 2023

ChatGPT mainly is what you make out of it. If you are an author it will help you writing. If you are a tech analyst it will help you create a list of critical capabilities for a certain species of software tools. And if you want to hack into a network it will help you writing code that can be used maliciously.

A prompt guides language models like ChatGPT to create meaningful and useful output. This workshop will teach you the best practices for crafting prompts that result in meaningful and accurate responses. You'll learn how to structure your prompts to elicit specific information, as well as techniques for fine-tuning the model to suit your needs. Whether you're a developer, researcher, or just a curious individual, this workshop is designed to give you the skills you need to unlock the full potential of ChatGPT. Join us and take the first step towards creating truly intelligent conversational systems..

When we asked ChatGPT to create a workshop abstract for Identity Security Professionals, this was the output it provided:

"Prompt Engineering is a powerful tool that can enhance the abilities of identity security professionals to perform their job more effectively. The workshop will equip attendees with the skills they need to engineer AI prompts and leverage AI tools to research, communicate, understand new technologies and threats, understand malicious code, detect or scan for vulnerabilities, generate countermeasures, and summarize their findings and communicate status and results effectively.

Attendees will learn how to use natural language processing techniques and machine learning to improve the efficiency and accuracy of their work, and gain a deeper understanding of the most recent trends and developments in the field of identity security. Additionally, by providing an in-depth examination of the latest methodologies and tools used in prompt engineering, attendees will be well-equipped to stay ahead of emerging threats and secure their organizations' sensitive data."

Watch

Event Recording

The MFA Dilemma and Moving Beyond Mobile

May 10, 2023

This panel will explore the current state of multifactor authentication (MFA) and its limitations, as well as potential solutions for improving the security and user experience of MFA. We will discuss topics such as the challenges of implementing MFA, the limitations of mobile-based MFA, and alternative methods for MFA, such as biometrics and behavioral analysis. The panel will also address the future of MFA, discussing the potential for new technologies to improve security and user experience, and the role of industry and government in shaping the future of MFA. Overall, the panel aims to provide valuable insights and perspectives on the multifactor authentication dilemma and the steps needed to move beyond mobile-based solutions.

Watch

Event Recording

Cyber Insurance as a Damage Mitigation Strategy

May 12, 2023

Digital transformation came with a wide range of advantages, but it also opened the door to potential cyberattacks. Every organization faces the risk to be the target of a cybercrime, but the transition to business digitalization leaves a greater room to present vulnerabilities in the system, and if attackers happen to identify them, the attack will occur. The world is changing rapidly, and companies must change with it, and so insurers see their possibility to break into the market. Is it worth to have a cyber-insurance policy? Does it cover all the damages? What is the extent of insurers responsibilities and the company one? Could these cases go to court and under what conditions?

Watch