Event Recording

3 Dimensions of Digital Sovereignty

Show description
Speakers
Benoît Jouffrey
CTO of Thales Digital Identity & Security
Thales Digital Identity & Security
Benoît Jouffrey
Benoît is actually the CTO of Thales Digital Identity & Security.   He is in charge of the worldwide technical and innovation strategic plan and overall engineering coordination. His ambition is notably to identify and implement new technologies that can improve...
View profile
Maarten Stultjens
VP Global Enablement IAM
Thales Digital Identity and Security
Maarten Stultjens
Maarten is VP Global Enablement IAM at Thales Digital Identity and Security. He has a passion for identity and access management (IAM) and information security. On a daily basis he is in close contact with customers, IT-industry analysts, technology partners and deployment partners...
View profile
Playlist
European Identity and Cloud Conference 2023
Event Recording
Entitlements - Claim vs. Reality
May 10, 2023

The claim or desire for authorizations, permissions and the rights set in practice often have a wide divergence. Typically, more rights are assigned unconsciously than were actually required.

The resulting vulnerabilities can have significant consequences therefore, it is essential to be able to monitor the true permissions at any time, regardless of how the permissions have been set. It is almost impossible to manage monitoring manually, even in small environments. Therefore, independent automatisms that can automatically explore, analyze and report the real settings are becoming a requirement.

In this session we will show you how Cygna Labs can support you in these challenging tasks and thereby ensure and improve security in your company.

Event Recording
Reduce Certification Fatigue with Effective Role Management
May 10, 2023

IAM and security leaders end up certifying far more access than necessary, owing to a failure to classify business resources. Furthermore, business users pay the price because they must spend an inordinate amount of time filling out these lengthy surveys. Benoit will show how to reduce certification fatigue through robust role management, which helps business users achieve better results while taking less time out of their day.

Event Recording
Verifiable Credentials for the Modern Identity Practitioner
May 10, 2023

You heard about Verifiable Credentials and decided to learn more. You found some stuff online, but despite knowing your way thru identity, you still can't really tell how they work in practice (wallets? presentations?) or how the boldest claims (no more centralized DBs! Apps cannot save PII!) will play out. This session will dive into VCs and separate the hype from their true, remarkable potential.

Event Recording
Panel: What Happens When Applications Don't Use the Identity Standards We Have Built
May 11, 2023

OAuth 2.0 is a widely adopted standard for authorization, but it can be complex to implement correctly. It's not uncommon for developers to have difficulty understanding the nuances of the OAuth 2.0 flow and instead rely on simpler approaches such as using API keys in "god mode."

OAuth 2.0 can be difficult to set up and configure, especially for developers who are new to the standard. It involves creating an OAuth 2.0 client, setting up redirect URIs, and managing access and refresh tokens, which can be confusing and time-consuming. Additionally, the standard requires developers to handle user authentication and authorization separately, which can be difficult to understand for those who are not familiar with the concepts.

Many developers may not understand the security benefits of OAuth 2.0 over API keys. OAuth 2.0 allows for fine-grained access control, enabling developers to limit access to specific resources and actions. In contrast, API keys provide more open access, allowing all actions on all resources. Developers may be inclined to use API keys instead of OAuth 2.0 because they are simpler and easier to implement, but they don't offer the same level of security.
Developers may find it hard to understand the standards, and may end up using an inconsistent approach.

The panel will discuss these reasons and other potential causes for why developers may not be using OAuth 2.0 correctly, and provide recommendations for how to overcome these challenges. We will highlight the benefits of OAuth 2.0, such as improved security and the ability to provide fine-grained access control, to encourage developers to adopt the standard. Additionally we will give examples of real-world attack scenarios that could have been avoided if the application was using OAuth 2.0.

Event Recording
Ahead of the Curve - the Customer Demands it, the Market Demands it, do You?
May 10, 2023

Companies today are being faced with business-critical yet seemingly conflicting topics; how to build trust, loyalty and personalized experiences that fuel growth in a world of fading cookies and GDPR. There has never been more urgency than now to focus on strategy and technology to meet the demands of the privacy-conscious consumer.  The collection of data and its management is core to this challenge, but current identity methods are missing the opportunity to solve it with legacy approaches and risk-based thinking. At IndyKite, we believe that facing this mounting challenge requires us to make leaps in both our thinking and technology implementations. Join us as we challenge the current operating state and discuss what the world might look like when we have the tools to power a truly customer-centric ecosystem - one where consumer data ownership and personalized services that fuel growth are no longer at odds. 

Event Recording
Better Safe than Sorry: A Peek into the Future with IGA
May 10, 2023

Engineers across organizations struggle with increased anxiety and stress every time they hit the push button to make complex system changes. One mistake can hinder business as usual, introduce unnecessary risks, and cause non-compliance with policies that can cripple the whole organization.

Simulations could be the answer engineers are looking for. They are used in various fields to study complex systems and help engineers create hypothetical scenarios to see the impact of certain changes before implementing them.

In this presentation, the Evolveum Development Team Leader, Katarina Bolemant, will explain the motivation and common pain points of deploying an IGA solution. She will show you the endless possibilities of using simulations to evaluate the impact of changes and how to identify potential issues and reduce the risks of errors. Using simulations will lift the burden off engineers’ shoulders, increase confidence in their decisions, and build stronger relationships with other stakeholders.

Offer a peek into the future, and both technical personnel and decision makers will appreciate you for providing the possibility to review the simulated results and make necessary adjustments before implementing changes in the production environment.

Event Recording
An Analysis of Global Decentralized Identifier Data
May 12, 2023

Decentralized Identifiers (DIDs) offer a unique solution for digital identity verification, allowing individuals to have complete control over their own identity and eliminating the need for a centralized registry or authority. In this session, we will explore the insights that can be gained through the analysis of global DID data. At Danube Tech GmbH, we have developed version trackers that monitor various DID methods, such as did:indy, did:ebsi, did:ion and others, collecting and storing data on DID transactions in our database for analysis. During this session, we will present the results of our latest analyses, including trends in DID transactions over time, distributions across different verification methods, and errors found in DIDs and DID documents. This information can be valuable for businesses looking to understand and utilize DIDs in their operations, as well as for individuals seeking to use DIDs for their own digital identity management.

Event Recording
Lessons Learned from IAM Transformation in Banking
May 11, 2023

Legacy IAM cannot be just "improved". It needs a "Transformation". But how an IAM transformation could be successful in the financial sector, especially banking? In this presentation I would like to share the top lessons learned from such a transformation.

Event Recording
Verifiable Digital Credentials: Comparison of Characteristics, Capabilities and Standardization of Emerging Formats and Issuance Protocols
May 10, 2023

In 2022, several standards organizations and open source groups made great progress defining protocol specifications and code for the issuance of digital credentials. In this session, learn about and discuss some of the emerging issuance protocols, and compare their features, capabilities and trade offs.

Event Recording
Designing the New Identity Fabric
May 11, 2023

Modern applications and environments are driving a new Identity Fabric.  Are you ready to build yours?  Join Vadim Lander, Chief Technology Office and Distinguished Engineer at Broadcom Software, as he discusses the design considerations to evolving your Identity and Access Management solution to build a Zero Trust foundation and bridge the identity gap across your hybrid environment.  

Event Recording
Zero Trust with Zero Buzz
May 11, 2023

The objective of the talk is to:

  1. (10%) Clear out the noise around Zero Trust: why Zero Trust has became a buzzword
  2. (20%) Define Zero Trust
  3. (60%) Set the journey:
    • how can we implement Zero Trust?
    • where to start? how to do it?
    • what are the building blocks?
    • building blocks stages and maturity?
  4. (10%) How can Zero Trust protect us against today's threats.
Event Recording
Validating the Security of Mobile Authentication Apps
May 10, 2023

You are shifting through RFIs for a new mobile app based multi-factor authentication solution for your company. The vendors claim that their products are 100% secure and we all know that there's no such thing as a 100% secure solution, but it's marketing and you know how marketing sometimes goes overboard. How do you determine if the solution is actually fit for your appetite for risk? Can you be sure development time dev credentials have been cleaned up? Is the rooting detection any good? Does the app store plaintext credentials? Is it vulnerable or can someone build a scalable attack against the product you are about to acquire to protect your crown jewels? Let's take a look at different options out there and talk a little bit about what you can request from the vendors.