Ensuring robust and secure digital identity is vital to enabling online and increasingly offline transactions. At present, however, there exist numerous different views on how digital identity systems should be implemented, resulting in a divergent range of global approaches.
There is a need to develop a system that enables interconnectivity and mutual assurance and trust between different approaches, in order to support economic and social transactions in a way that allows local relying parties to make risk-based decisions. Furthermore, this system must protect
individuals’ privacy and be able to do so across national boundaries.
Some of the same approaches that exist in the physical world, such as those used to assure passport integrity, need to be applied in the digital world. Greater collaboration is required in order to better understand the wide range of current differing approaches. Consideration also needs to be given to how to deal with the threats posed in a distributed environment, noting that some of the participants in that environment may be motivated to abuse their privileged positions.
Heterogeneous approaches across the globe
Establishing a robust and globally interoperable approach to digital identity management is critical to realizing the potential economic and societal value of the digital ecosystem in the next 5–10 years. By getting digital identity right, there is the potential to solve existing security and privacy challenges, facilitate a low-friction global market, support the digital transformation of existing services, and create opportunities for businesses and public services to unlock new value by offering new types of trusted services (e.g. in transport, commerce and finance).1Interoperable identity-management systems, while not comprising the entirety of the solution for economic and social inclusion globally, are a necessary precondition.
It is widely agreed that the way in which identity is currently managed within the digital ecosystem is suboptimal. Weak identity management is exacerbating cybersecurity issues and is at the root of many forms of cybercrime, while the lack of interoperability between isolated solutions is acting as a barrier to unlocking value.
The reimagination of digital identity is ongoing. There have been efforts by various national governments and regional bodies, as well as industry-led efforts, to implement digital identity management approaches. The specialist identity community has established principles; supporting technologies exist; and identity solutions are being implemented in new use cases. Significant challenges will have to be faced in terms of implementing identity systems and
supporting technologies, incentivizing actors to play their part in the emerging identity ecosystem, and ensuring that parts of the global population are not excluded.
Competing paradigms and investments in a diverse range of solutions (due in part to differing contexts across countries, sectors and companies) have created a fragmented landscape of identity approaches. Achieving the level of interoperability needed to support transactions across multiple sectors and jurisdictions is, and will continue to be, challenging. These issues are being examined and addressed by the relevant communities.
Digital identity, if managed in the right way, could clearly form an important part of the security and privacy solution, helping to address challenges, including some of those arising from other emerging technologies (e.g. strong authentication guarantees could help mitigate the risk of AI- based impersonation). There are security and trust challenges, however, that need to be addressed as the next-generation digital identity ecosystem emerges. The community should recognize that business and digital services are becoming increasingly entangled. Total trust of identities from heterogeneous systems is unrealistic, but zero trust is likely insufficient to support the desired transactions. Federated identity systems are needed, which share and project sufficient trust across supply chains to deliver services. Therefore, the community will need to find a global model for transitivity of trust.
Security risks to digital identity systems
As next-generation identity systems emerge, society will build up an increasing dependence on using them in critical applications.167 168 The high-value identity ecosystem is likely to be heavily targeted. Increasingly sophisticated threat actors will capitalize on the opportunity to exploit vulnerabilities in its component parts (e.g. authentication devices and mechanisms, access-management, communications and databases) and the actions of users in order to take over accounts, subvert transactions and harvest sensitive data, for example. Criminals will seek to abuse the system for financial gain, and various actors within the digital identity ecosystem (e.g. industry identity providers and governments) may seek to exploit their position to gain economic or political advantage, both overtly and covertly.
The risks to the security of emerging identity systems can be considered in terms of their confidentiality, integrity and availability.
• There will be a major confidentiality risk to the large amounts of personal information managed by identity systems (including personally identifiable information [PII], and biometric, behavioural and locational data). Minimizing the risk to this data will be critical.
• There is a risk that the integrity of the identity ecosystem will be subverted, reducing the confidence of participants in it. For participating actors, there are challenges to establishing the integrity of the components they depend on (particularly in cases where there is a trust deficit), and establishing their competence in protecting their part of the ecosystem against abuse.
• There is an availability risk: that attackers will attempt to prevent access to or use of identity infrastructure. If the infrastructure does not have the necessary resilience and fallback modes, then attacks on the availability of systems on which services depend critically could have grave consequences. Achieving resilience will be particularly challenging in those elements of society where infrastructure (both technical and governance) is weak.
Defenders will face new cybersecurity challenges associated with building a secure identity ecosystem and ensuring its integrity on an ongoing basis. Compromise will have increasingly severe and systemic impacts, and undermine the trust between actors that is necessary for the system to operate effectively.
Access to Innovation
Access to Capital
Access to Talent
Access to Market
Access to Knowledge
