Analysis of standardisation requirements in support of cybersecurity policy
Digital services and electronic transactions are becoming more and more important. This trend has been accelerated by the COVID-19 restrictions limiting in-person contact, which increased digital interactions between people around the world. However, electronic transactions in which the identities of parties cannot be trusted give rise to fraud. Digital identity – that is, the identification of a legal or natural person or an entity within an electronic service – is more important than ever.
‘Digital identity’ is defined, for the purpose of this document, as a unique representation of a subject engaged in an online transaction. This contains two elements constituting the role of digital identity: to represent a subject and to support an online transaction. ‘Identity’ itself can be defined as a set of attributes related to an entity.
There is a multitude of standards in the area of digital identity. The goal of this document is to give an overview of the most important standards and standardisation organisations in this area. This information is useful for the novice, to find out what is available, but also for more experienced readers who might not be aware of some (parts of) existing standards. It also provides an analysis of standards related to different means supporting digital identity. This covers means created and managed by trust services, electronic identification means and the EU Digital Identity Wallet.
Digital identity standards cover several areas. They can describe policies; services issuing or managing digital identity means; formats and protocols to be used; ways of auditing related services; requirements for secure devices; or recommended processes and algorithms.
Digital identity standards have been developed due to the increasing demand for secure, reliable and cross-recognised digital transactions, fuelled by several governmental digital transformation programmes and the COVID-19 restrictions. The standardisation efforts involve several layers of digital identities, extending from the policy and governance level down to the operational and technical specifications level. They also address several elements and technologies supporting digital identities, such as electronic certificates, person identification, signature devices and cybersecurity aspects.
The following criteria are considered in the analysis of available standards:
- coverage of the identity management life cycle,
- maturity of the standards,
- authentication capabilities (in person versus remote, online versus offline),
- user sole control and dependencies, for example whether ‘call home’ is needed,
- data-protection-enhancing technologies, for example selective disclosure,
- trust model.
Based on this analysis, we propose a series of recommendations on the digital identity standardisation requirements in support of cybersecurity policy standards for various groups of stakeholders: EU policymakers, European Standardisation Organisations (ESOs) and ENISA.
Views: 0
