Trust Frameworks: Are current Strategies Realistic?

1. Trust Frameworks: Are current
Strategies Realistic?
Colin Wallis
Jeff Stollman

2. Presenters
Jeff Stollman
Consultant
Secure Identity Consulting
Colin Wallis
Authentication Standards Manager
Government Technology Services
New Zealand Government

3. Identity is not the center of the
universe.
And other heretical views on trust
frameworks.

4. Agenda
• Problem 1: Are Current Strategies Realistic?
• Problem 2: Trust-Centricity vs. Identity-
Centricity
• Problem 3: Defining terms
• Problem 4: Specifying requirements

5. ARE CURRENT STRATEGIES
REALISTIC?
Problem 1:

6. Free-Trade Zone

7. TRUST-CENTRIC vs.
IDENTITY CENTRIC
Problem 2:

8. Do we have the right model?

9. Changing Paradigm

10. Shortcomings of the Identity-centric
Model
1. Few transactions actually require knowing the
identity of the person with whom you are
dealing
2. Many of the traditional tokens we use for
identity, were not even developed to verify
identity
3. We haven’t taken the time to agree on what
identity even means.
4. We haven’t specified requirements for what
identity should be

11. ….but only when it matters.. Mostly it’s OK being the same
dog that logged on last time
Identity is not central to many
interactions

12. Do sellers NEED more than proof of
payment?

13. There is an alternative

14. Breaking down the Trust Function
Identity
Identity
Terms
Subsidiary Rights
Enforcement
Terms
Subsidiary Rights
Enforcement
Security
Security
Trust = F(I, T, SR, E, S)

15. DEFINING TERMS
Problem 3:

16. Talking past each other
Identity

17. SPECIFYING REQUIREMENTS
Problem 4:

18. Treasure Hunting
Without a Map

19. We have been building tools to dig
with

20. Definitions and Requirements
Definitions
Requirements
Results
Tools
Notional GoalsDefined
Ignored
Ignored
In process
?