Every credential has a risk profile. In the case of traditional physical credentials, these risks are well understood – the risks of various types of forgery, impersonation, synthetic identity creation, theft, etc. In the case of digital credentials, a new set of risks must be considered. For example, a credential may be cryptographically valid, or otherwise fraudulent. How was the credential issued? What level of identity proofing was done? How trustworthy were the relying credentials? What are the security protocols of the issuer? Is there a central (hackable) database of all of this type of credential? Are the PKI tokens secure? Is the credential stored in a secure wallet? Is the credential biometrically bound to the holder?
As privacy laws have been enacted in many countries, these concerns are also important compliance considerations for companies using these identities.
Developing a Risk Universe
A holistic risk universe is foundational to managing risk. A risk universe is a comprehensive set of all of the risks that might (or might not) be relevant to an organization. To operationalize risk management, organizations begin by examining the risk universe and then settle on a smaller set of risks (aka a risk register) which they consider relevant to their business or interests. They then assess and manage those risks carefully.
We propose to develop a holistic risk universe in the form of a report and accompanying Excel file/map that will explore three risk domains in depth:
- Trustworthiness: Is this credential trustworthy?
- Privacy: What privacy risks do holders incur when using this credential?
- Security: What are the end-to-end security risks associated with this credential?
Note 1: We propose to scope ‘privacy risks’ to include both user-related risks and privacy compliance risks for verifiers
Note 2: Security risks overlap with both trustworthiness and privacy risks.
A draft proposal is available here.
If you are interested in participating in the Risk Universe DG, please complete this form. Kantara staff will then get in touch regarding meeting dates.
More information on forming and participating in Kantara Discussion Groups can be found in the Kantara Initiative Operating Procedures, Article 5.
Work Group leader
Key information for the Digital Identity Risk Universe Discussion Group
We encourage you to submit queries on our contact form if you have any questions regarding this Work Group. Interested in sponsoring the DIRU Discussion Group? If your brand and organization values align with our mission, please get in touch.
Additional information for the Digital Identity Risk Universe Discussion Group
Participation offers an unrivalled opportunity to network and collaborate with some of the industry’s most prominent figures including representatives from relying parties, government agencies and standards bodies
Digital Identity Risk Universe Discussion Group calendar
This calendar lists all meetings and events relevant to this Work Group. You can also use the FILTER to see the calendars of our other Work Groups
“Kantara Initiative plays an important role in the market by signaling that any claims about our services have been independently verified and are, therefore, reliable.”
