Showing posts with label Digital Transformation. Show all posts
Showing posts with label Digital Transformation. Show all posts

Thursday, 20 December 2018

The inevitability of digital identity


At this time of year, it’s a great opportunity to reflect.  Not only what we’ve achieved in our work life.  Also, what we’ve done with our family time too.  I am lucky to live in a small village on the outskirts of one of the greenest cities, Sheffield.  I enjoy, after a hard week at work, being able to leave my front door and step into the beautiful Moss Valley.  Whether it’s a stroll across the open fields, a trek through the ancient woodland, or meandering through the budding plantations.  Wandering aimlessly is a fantastic way to clear my mind, relieve the stresses of the working week, and get in some exercise.

And having expended plenty of energy, next is coming home to cook some fresh local produce.  As much as I enjoy cooking, what really motivates is my love of eating good food.  Knowing that a bunch of fresh ingredients have been used to create a meal, makes eating it all the more pleasurable. 

One of the other things I enjoy is watching movies.  I recently watched “28 Days Later”.  As with any good zombie movie, the plot follows a simple formula.  An infection causes people to be turned into the walking dead. The infection is spread by an ever-growing army of these zombies; biting and scratching the remaining humans to enlist them.  Large pockets of resistance eventually becoming small guerrilla groups, fighting for the survival of the human race.  Each being picked off, one by one, as they search for safe refuge.



Watching these zombies wandering aimlessly, eating the things that they found along the way, and even indulging in other activities that I’ll leave to your own imagination.  Then seeing the bunch of surviving humans, panic stricken, hiding, fighting for their lives.  And of course, along the way the humans would be picked off by the zombies.  Their last days being spent in fear, suffering and pain.  This made me think.  Being turned into a zombie, where I could indulge in favourites pastimes without needing to worry about work, would I fight or should I just submit to the inevitable?

So, back on the topic of work.  Digital Identity.  This week, Facebook are again in the news.  Allowing companies access to their user’s private messages, with the ability to read and even delete being granted contrary to their typical privacy rules.  Facebook relied upon the trust of the organisation whom they had a commercial relationship with not to do anything bad.  And whilst the intention of doing so may have been to create better user experiences, the lack of transparency is worrying.

In the UK, since 2016, landlords have had to confirm the “right to rent” of their tenants.  This involves ensuring tenants have the requisite immigration status.  With the risk of fines, the increased costs of checking, landlords are unsurprisingly resorting to the path of least resistance.  Those who hold a current British passport are fairly easily checked.  For those who don’t, being white and having an English accent provides another easy route.  The result of this is discrimination based on ethnicity and social status, leaving many people unable to access an already competitive market.

Technology for authentication and identification of users continues to evolve.  Artificial intelligence and machine learning are playing an increasingly important role.  Yet gender and racial bias are a known problem.  My paragraph above about the rental market may have just contributed to this bias.  Landlord?  Does that mean only men own property?  (this is the term used on the Government’s website by the way).  As the machines scour the internet for data, this becomes a logical conclusion based on the information available.  Whilst we need to embrace technology, we also need to recognise the bias and ensure that we don’t create discrimination.  Making a great experience for one group at the expense of another isn’t a sensible endeavour.

Digital identity can be a tool for good.  It can put data back in the control of the individual to whom it belongs.  It can ensure that transparency and consent are performed to the spirit of data protection, not just to the letter.  It can enable anyone to assert their credentials without undue friction and effort.  It has the ability to drive costs savings, efficiencies, and personalisation in user experiences.

In the next decade, how we identify ourselves today will change.  We’ll be more connected than ever before.  We’ll interact with more important, valuable, sensitive and trusted services through digital means that we do today.  Online and physical channels will homogenise because users will demand that they do; they will stop interacting with those that don’t.  Globalisation will remove national boarders in the digital market, driving a need for standards and interoperability.  Physical identity documents will become increasingly expensive, insecure and inconvenient.  Identity theft and fraud will be incredibly sophisticated. Digital means of identity will be prevalent.

It is inevitable that how we prove who we are will change.  Sitting back and waiting for the privacy trampling, exclusive, opaque, leaky solution to emerge may be the path of least resistance.  Though do we really want to be a zombie? 

Looking forward to 2019, I’ll continue accelerating the adoption of good digital identities that deliver on the benefits outlined above.  It may be painful, I may suffer a few blows along the way, though with a bit of luck I won’t be one of those picked off.  Next December, I hope to be writing about the new world.  Where good digital identity is making life better for society as a whole.  And maybe, next year’s festive theme won’t be about zombies.  Instead it will be something more fitting.  Like radioactive sheep.

Merry Christmas and a prosperous New Year to all. 


Read my other posts
Check out my other posts https://no1ba.blogspot.com

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture.  Bryn has over 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA



Connect with Bryn on Linked In: Bryn Robinson-Morgan

Monday, 20 August 2018

My convenience, your security


Last week there was fraud event with my credit card.  Fortunately, my card company spotted the attempted fraud and blocked any transactions – so no hassle arguing over money.  What it did mean however was that I was stranded, away from home, with no credit card to pay for my return train tickets.  Throughout the entire experience, security was a distant thought; all I cared about was (in)convenience.

Having been notified about the attempted fraud, it took me 24 hours to actually contact my card company.  This wasn’t because I was on top of a mountain with no phone coverage – or that I’d been held captive by the fraudsters - the simple truth is that I wasn’t that bothered.  It was so low down my list of priorities that it disappeared from day one’s task list, and on day two I forced myself to do it first thing otherwise I knew it would drop off again.  I didn’t know how serious the attempted fraud was – was it a half-assed attempt on an online payment, had they tried to access my account using my personal details?  I still don’t know exactly what happened, “security reasons” mean that I don’t get to know the what, why and where.  This lack of involvement is definitely one of the reasons why I see the problem as my card companies, not mine; and why I care more for my convenience than their security.


When on the phone, I went through the usual knowledge-based authentication.  What’s my favourite colour of dog?  What month was my rabbit born?  The usual process that leaves me feeling cold when there are much more modern ways of secure communication.  Hey, is it any wonder that you’re having to deal with your fraudsters with legacy security processes?    They satisfied themselves that it wasn’t me who’d tried to buy a Gucci handbag from a website in Guatemala or whatever had occurred.  Now they’d cancel my old card and strap a new one to a homing tortoise.  What?  Cancel my card?  I need it!  I can’t wait for you to send me a new one.  Obviously, I was terribly sad to hear of their security problems, not sad enough that to solve it they’d have to inconvenience me.  After much grumbling, and telling me repeatedly that there was no choice other than cancel the old one,
they eventually agreed to at least deploy the new one via homing cheetah instead. 

After hitch-hiking back home, spending another day grumbling about the inconvenience of it all, my new card arrived.  Security as the top concern, my card company has sent this using a signed for service.  So obviously the delivery person had scribbled on their pad themselves and left it securely propped up by my front door.  Convenient for them, convenient for me.  Not so secure for my card company.

Now those who know me, will be surprised that I’ve been talking about a credit card; I don’t actually use the card.  I use Apple Pay.  This was my next point of inconvenience, having to set up my card on my phone and watch.  Except that it wasn’t inconvenient at all.  It was either witchcraft or some sort of data sharing between my card provider and Apple.  When I selected to add a new payment card to my wallet I was asked if it was the card ending in the last 4 digits that my card provider had sent me.  Instantly I forgot about GDPR and informed consent and personal data.  This was convenient… and kind of cool.

Sadly, not everyone accepts Apple Pay – though happily, for convenience again, I can usually save my payment details with the service providers that I use regularly.  One such provider is the App where I buy my train tickets from.  Now this App is absolutely awful.  It looks like the train company asked their office cleaner to develop it for them.  And high on the fumes of Vim mixed with Bleach the cleaner agreed to do this despite not having any of the skills required to do so.  Yet using it means that I have access to eTickets.  No print at home or collect from the station for me – eTickets all the way… convenient.  Given how awful I said the development of the App is, I don’t really have great confidence in how secure it is either.

If I was a betting man, I’d guess that the fraud on my card was more likely to have come from the train company that Apple.  Though I also know that I’m using my card as designed when I fill them in and when I click the button to save for future use.  If the card company doesn’t use the best security, then it would appear that neither of us are that bothered.  Maybe convenience is best for both of us.  My new card details are now in the place where the old ones were.  The same pattern repeated across all my regular interactions.

Unless my card company changes to show me that security is important to them, and educates that security is important to me – mutual authentication as a minimum for communication regardless of channel, tokenisation and identity in payments, customer centric fraud prevention – then convenience will remain my priority and security will remain their problem.

Read my other posts
Check out my other posts https://no1ba.blogspot.com

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture.  Bryn has over 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA


Connect with Bryn on Linked In: Bryn Robinson-Morgan