Identity infrastructure: security considerations
Richard Walton · Computer Fraud & Security · 2005
Italy plans to introduce biometric ID cards to every one of its citizens within the next six years. The UK Government is attempting to follow. Identity infrastructures today are creaking under the strain of modern-day identity theft. Governments are touting the ‘war against terror’ as the main reason for introducing identifiers such as ID cards. But the economic driver for a new identity infrastructure is much more immediately obvious than any security benefits. High quality means of identification are vital for the continued support of E-commerce growth. A radical redesign of the current identity infrastructure is needed believes Professor Richard Walton, former director CESG. The technology to do this to an adequate standard is available now. The technical capabilities, which are needed to build such an infrastructure include: databases, smartcards, biometrics and cryptography. Some are stronger than others. In addition, some of these technologies bring worries of civil liberty infringement and the possibilities of security compromises. Many measures are needed to counter all these potential problems. A Regulatory Authority should be set up to monitor usage of the identity database, for example. Appropriate recovery processes should be in place for when thing go wrong as they inevitably will. An identity infrastructure overhaul is needed to keep up with the E-commerce boom. The UK Government has tended to concentrate on the security driver, that is on the role of an identity infrastructure in supporting the fight against crime - especially terrorism. This focus is understandable but in my view, misguided. Economic drivers are much more obvious. The technology is available now to create a new ID infrastructure but it must be meticulously implemented as the possibility of system cracks could be inevitable.