This document discusses trends in identity and access management. It notes that identity standards like OpenID Connect are rising while others like SAML are fading. Authentication methods are shifting from traditional multi-factor authentication to continuous adaptive authentication. Privacy and centralized identity systems are concerns driving interest in self-sovereign identity models using blockchain and decentralized identifiers. Large countries are implementing national digital identity systems and blockchain may help improve transparency. The role of mobile identity is growing as phone numbers become integral identifiers.

1. Senior Director of Security Architecture, WSO2
Identity is Eating the World!
Prabath Siriwardena (@prabath)

2. INFORMATION CARDS
NEW PARADIGM FOR AUTHENTICATION TO FIGHT
AGAINST PHISHING
BORN IN 2006 - DEAD IN 2011

3. CONTINUOUS / ADAPTIVE AUTHENTICATION
WSO2 IDENTITY SERVER TO SUPPORT ADAPTIVE
AUTHENTICATION IN 5.7.0
MFA COULD REDUCE THE ACCOUNT COMPROMISE BY 99.99%
90% GOOGLE USERS HAVE NOT ENABLED 2FA
CONTINUOUS AND ADAPTIVE AUTHENTICATION ARE THE THE NEXT
PHASE OF MFA

4. THE WORLD BEFORE 2005
THE RISE OF WEB 2.0 AND SOFTWARE-DRIVEN ECONOMY
NO PUBLIC FACEBOOK, NO YOUTUBE, NO INSTAGRAM,
NO WHATSAPP, NO TWITTER

5. 1 BILLION OPENIDs BY 2009
WSO2 IDENTITY SERVER ENABLES OPENID LOGINS FOR 4M+
SAUDI CITIZENS
CALL FOR STANDARDS!
NO ONE IS USING OPENID TODAY, EXCEPT AMAZON

6. STANDARDS, CONSENSUS RULE!
STANDARDS ARE NOT HERE TO STAY FOREVER
OPENID CONNECT REPLACED OPENID
OAUTH 2.0 REPLACED OAUTH 1.0
SCIM REPLACED SPML

7. RIP XACML!
CUSTOM POLICY LANGUAGES FOR ACCESS CONTROL
ARE ON THE RISE
KEEP AN EYE ON OPA!

8. THE RISE OF OPENID CONNECT!
92% OF THE 8B+ AUTHENTICATION REQUESTS AZURE AD
HANDLED IN MAY 2018 WERE FROM OPENID CONNECT
ENABLED APPLICATIONS
SAML 2.0 STARTING TO FADE OUT

9. THE TCP/IP MOMENT OF IDENTITY
TCP/IP WAS A LUXURY IN EARLY 1980s BUT NO MORE!
SUPPORTING IDENTITY STANDARDS IS A MUST
NO IAM VENDOR TO GET COMPETITIVE ADVANTAGE BY
JUST SUPPORTING STANDARDS

10. ACQUISITIONS, MERGERS AND PARTNERSHIPS LEAD
TO BUSINESS GROWTH
BY 2020, 60% OF ALL DIGITAL IDENTITIES THAT INTERACT WITH
BUSINESSES WILL COME FROM EXTERNAL IDENTITY PROVIDERS
SILOS KILL GROWTH OPPORTUNITIES

11. OAUTH 2.0: THE LITTLE MAGICIAN
OAUTH 2.0 IS BECOMING THE GLUE FOR ALL IDENTITY INTERACTIONS
ENTERPRISES DIDN’T GO WITH OAUTH 1.0, BUT WITH OAUTH 2.0

12. THE RISE OF MOBILE IDENTITY
WSO2 IDENTITY SERVER ENABLES MOBILE CONNECT FOR MORE
THAN 800 MILLION SUBSCRIBERS IN INDIA
MOBILE CONNECT GETTING TRACTION IN EUROPE AND
ASIA PACIFIC
TURNS ALL MOBILE NETWORK OPERATORS INTO IDPs

13. IN 2017, THE NUMBER OF PEOPLE CONNECTED TO
MOBILE SERVICES SURPASSED 5 BILLION
IN 2025 IT IS EXPECTED THAT THIS NUMBER WILL REACH 5.9
BILLION, WHICH IS ALMOST 71% OF THE WORLD POPULATION
MOBILE ADOPTION IS UNSTOPPABLE

14. IDENTITY IS THE NEW MONEY
DAVID BIRCH WRITES THE BOOK, IDENTITY IS THE NEW
MONEY IN 2014
EVERYONE WE KNOW, IS NOW REPRESENTED BY
A 10 DIGIT NUMBER
MOBILE PHONE, WHICH IS TIED TO ONE’S IDENTITY ALSO
COULD ACT AS MONEY

15. AADHAAR PAY IS POWERED BY AADHAAR
1.2 BILLION AADHAAR NUMBERS
THE LARGEST DIGITAL IDENTITY SYSTEM ON EARTH
AADHAAR
AADHAAR COLLECTS NAME, DOB, GENDER, ADDRESS, MOBILE NUMBER,
EMAIL ALONG WITH FINGERPRINTS AND IRIS

16. AADHAAR PAY IS A DIGITAL PAYMENT PLATFORM FOR MERCHANTS
WENT LIVE IN APRIL 2017, WITH 20 BANKS IN INDIA
AADHAAR PAY

17. INTEGRATED AUTOMATED FINGERPRINT IDENTIFICATION SYSTEM
(IAFIS) RUN BY FBI HAS 70M+ CRIMINAL RECORDS ALONGSIDE
34M+ CIVIL RECORDS
NOT JUST AADHAAR!

18. PRIVACY IS MOSTLY ABOUT HOW MUCH CONTROL YOU HAVE
OVER YOUR OWN PERSONAL IDENTIFIABLE INFORMATION
ALEKSANDR KOGAN WAS ABLE TO GRAB PERSONAL DATA OF
87 MILLION FACEBOOK USERS AND LATER SHARE THEM WITH
CAMBRIDGE ANALYTICA
PRIVACY, NO MORE A LUXURY!

19. PRIVACY CONCERNS AND GROWING ANGER AGAINST
CENTRALIZED SYSTEMS ARE ON THE RISE!
THE RISE OF THE INTEREST ON SELF-SOVEREIGN IDENTITY
KILL THE KING!

20. CENTRALIZED | FEDERATED | USER CENTRIC |
SELF-SOVEREIGN
PATH TO SELF-SOVEREIGN IDENTITY
MICROSOFT PASSPORT IS ONE OF THE VERY FIRST
FEDERATED IDENTITY SYSTEMS ON THE WEB

21. ANY KIND OF A CENTRALIZED SYSTEM IS JUST A HONEY
POT AWAITING TO BE ATTACKED!
FACEBOOK, GOOGLE, MICROSOFT, YAHOO, ALL MANAGE
YOUR IDENTITY CENTRALLY
CAMBRIDGE ANALYTICA NEVER HAD TO INTRUDE FACEBOOK TO
GET HOLD OF PERSONAL DATA
PERSONAL DATA OF MORE THAN 143 MILLION AMERICAN RESIDENTS
WERE EXPOSED IN EQUIFAX ATTACK
BLURRED BORDERS

22. DNS IS A DISTRIBUTED, CENTRALIZED SYSTEM WHICH IS
GOVERNED BY ICANN
THE MANAGEMENT OF THE COUNTRY-TLDS OF AFGHANISTAN
AND IRAQ WERE REASSIGNED DURING THE WAR TIMES
WIKILEAKS WAS BLOCKED IN USA AFTER THE
DISCLOSURE OF DIPLOMATIC CABLES
MORE WORRIES ON CENTRALIZED TRUST!

23. THERE ARE MORE THAN 70 MILLION SMALL BUSINESS
ON FACEBOOK, USING IT ON A DAY TO DAY BASIS
WHAT IF FACEBOOK IS BANNED?

24. THE HOLDER IS THE OWNER OF THE
IDENTITY INFORMATION
DID OR THE DECENTRALIZED IDENTIFIER IS
A GLOBALLY UNIQUE IDENTIFIER
SELF-SOVEREIGN IDENTITY ARCHITECTURE
ESTABLISHES A LIFETIME PORTABLE
IDENTIFIER

25. BLOCKCHAIN 1.0 IS ABOUT CURRENCY
BLOCKCHAIN 2.0 IS ABOUT CONTRACTS
BLOCKCHAIN 3.0 IS ABOUT APPLICATIONS BEYOND
CURRENCY, FINANCE, AND MARKETS
BLOCKCHAIN GENERATIONS

26. THE ZOOKO’S TRIANGLE SAYS ANY IDENTIFIER CANNOT BE
UNIQUE, DECENTRALIZED AND HUMAN READABLE
ALL TOGETHER
BLOCKSTACK LETS YOU CREATE AN IDENTIFIER, WHICH IS
GLOBALLY UNIQUE, DECENTRALIZED AND HUMAN READABLE
UNIQUE, DECENTRALIZED AND MEMORABLE

27. BETTER AADHAAR WITH BLOCKCHAIN
BLOCKCHAIN HELPS TO MAKE AADHAAR TRANSPARENT AND
PUBLICLY AUDITABLE
ACCESS TO 1 BILLION IDENTITIES IN 10 MINUTES FOR RS. 500
1 IN 7 EMPLOYEES WOULD BE WILLING TO SELL THEIR LOGIN
CREDENTIALS FOR AS LITTLE AS $150

28. BRINGING BLOCKCHAIN IDENTITY TO THE REAL WORLD
ESTONIA KSI BLOCKCHAIN
STATE OF ILLINOIS
CANADA IS TESTING A DIGITAL IDENTITY SYSTEM BASED ON
BLOCKCHAIN
SINGAPORE
DUBAI

29. ID2020
MORE THAN 1.5B PEOPLE AROUND THE WORLD HAVE NO
PROPER LEGAL IDENTITY (IDENTIFIER)
PERSONAL, PRIVATE, PERSISTENT, PORTABLE IDENTIFIERS
LEGAL IDENTITY FOR ALL BY 2030
GIVING AN ID MEANS GIVING RIGHTS

30. TAKEAWAYS!
IDENTITY AND ACCESS MANAGEMENT IS A CROSS VERTICAL
DISCIPLINE AND A KEY ENABLER FOR DIGITAL TRANSFORMATION
STICK TO STANDARD BASED IAM FOR BETTER INTEROPERABILITY
AND FOR BEST PRACTICES
IDENTITY BASED PAYMENT SYSTEMS ARE ON THE RISE
MOBILE PHONE/SIM IS BECOMING AN INTEGRAL PART OF ONE’S
IDENTITY

31. LARGE SCALE NATIONAL DIGITAL IDENTITY SYSTEMS ARE ON
THE RISE
BLOCKCHAIN BASED IDENTITY SYSTEMS ARE USED BY
GOVERNMENTS. STILL EXPERIMENTAL AT THE ENTERPRISE LEVEL
IDENTITY IS EATING THE WORLD! NO ESCAPE! BE PREPARED!
MFA IS A MUST. THE NEXT SHIFT IS CONTINUOUS AND
ADAPTIVE AUTHENTICATION
TAKEAWAYS!

32. THANK YOU
wso2.com