The Alternate View

The inevitability of digital identity

noreply@blogger.com (Bryn Robinson-Morgan) — Thu, 20 Dec 2018 12:37:00 +0000

At this time of year, it’s a great opportunity to reflect. Not only what we’ve achieved in our work life. Also, what we’ve done with our family time too. I am lucky to live in a small village on the outskirts of one of the greenest cities, Sheffield. I enjoy, after a hard week at work, being able to leave my front door and step into the beautiful Moss Valley. Whether it’s a stroll across the open fields, a trek through the ancient woodland, or meandering through the budding plantations. Wandering aimlessly is a fantastic way to clear my mind, relieve the stresses of the working week, and get in some exercise.

And having expended plenty of energy, next is coming home to cook some fresh local produce. As much as I enjoy cooking, what really motivates is my love of eating good food. Knowing that a bunch of fresh ingredients have been used to create a meal, makes eating it all the more pleasurable.

One of the other things I enjoy is watching movies. I recently watched “28 Days Later”. As with any good zombie movie, the plot follows a simple formula. An infection causes people to be turned into the walking dead. The infection is spread by an ever-growing army of these zombies; biting and scratching the remaining humans to enlist them. Large pockets of resistance eventually becoming small guerrilla groups, fighting for the survival of the human race. Each being picked off, one by one, as they search for safe refuge.

Watching these zombies wandering aimlessly, eating the things that they found along the way, and even indulging in other activities that I’ll leave to your own imagination. Then seeing the bunch of surviving humans, panic stricken, hiding, fighting for their lives. And of course, along the way the humans would be picked off by the zombies. Their last days being spent in fear, suffering and pain. This made me think. Being turned into a zombie, where I could indulge in favourites pastimes without needing to worry about work, would I fight or should I just submit to the inevitable?

So, back on the topic of work. Digital Identity. This week, Facebook are again in the news. Allowing companies access to their user’s private messages, with the ability to read and even delete being granted contrary to their typical privacy rules. Facebook relied upon the trust of the organisation whom they had a commercial relationship with not to do anything bad. And whilst the intention of doing so may have been to create better user experiences, the lack of transparency is worrying.

In the UK, since 2016, landlords have had to confirm the “right to rent” of their tenants. This involves ensuring tenants have the requisite immigration status. With the risk of fines, the increased costs of checking, landlords are unsurprisingly resorting to the path of least resistance. Those who hold a current British passport are fairly easily checked. For those who don’t, being white and having an English accent provides another easy route. The result of this is discrimination based on ethnicity and social status, leaving many people unable to access an already competitive market.

Technology for authentication and identification of users continues to evolve. Artificial intelligence and machine learning are playing an increasingly important role. Yet gender and racial bias are a known problem. My paragraph above about the rental market may have just contributed to this bias. Landlord? Does that mean only men own property? (this is the term used on the Government’s website by the way). As the machines scour the internet for data, this becomes a logical conclusion based on the information available. Whilst we need to embrace technology, we also need to recognise the bias and ensure that we don’t create discrimination. Making a great experience for one group at the expense of another isn’t a sensible endeavour.

Digital identity can be a tool for good. It can put data back in the control of the individual to whom it belongs. It can ensure that transparency and consent are performed to the spirit of data protection, not just to the letter. It can enable anyone to assert their credentials without undue friction and effort. It has the ability to drive costs savings, efficiencies, and personalisation in user experiences.

In the next decade, how we identify ourselves today will change. We’ll be more connected than ever before. We’ll interact with more important, valuable, sensitive and trusted services through digital means that we do today. Online and physical channels will homogenise because users will demand that they do; they will stop interacting with those that don’t. Globalisation will remove national boarders in the digital market, driving a need for standards and interoperability. Physical identity documents will become increasingly expensive, insecure and inconvenient. Identity theft and fraud will be incredibly sophisticated. Digital means of identity will be prevalent.

It is inevitable that how we prove who we are will change. Sitting back and waiting for the privacy trampling, exclusive, opaque, leaky solution to emerge may be the path of least resistance. Though do we really want to be a zombie?

Looking forward to 2019, I’ll continue accelerating the adoption of good digital identities that deliver on the benefits outlined above. It may be painful, I may suffer a few blows along the way, though with a bit of luck I won’t be one of those picked off. Next December, I hope to be writing about the new world. Where good digital identity is making life better for society as a whole. And maybe, next year’s festive theme won’t be about zombies. Instead it will be something more fitting. Like radioactive sheep.

Merry Christmas and a prosperous New Year to all.

Read my other posts
Check out my other posts https://no1ba.blogspot.com

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has over 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Should banks be identity providers?

noreply@blogger.com (Bryn Robinson-Morgan) — Tue, 20 Nov 2018 14:45:00 +0000

The ability for citizens to use their digital identity in both public and private sector is paramount for a successful scheme. A digital identity must become a necessary and valued commodity for the individual. There are two sectors who can achieve this. Government and Financial Services.

Globally, Singapore and Estonia are two good examples of where governments have led on the creation of the scheme. Norway and Sweden good examples of where the banks have been the catalyst. Whether a government or bank led scheme, the identity provider being in the private sector has benefits. Private sector identity providers drive a customer focussed scheme with a sound commercial basis.

When thinking about what makes a good identity provider, banks tick many of the boxes. Systems underpinning our financial network may sometimes be viewed as legacy millstones. Yet what they do well is to define the standard of trust.

Banks may not necessarily be liked. Though customers, consumers, government and other actors in the sector do trust them. We know they can securely and accurately process hundreds of thousands of transactions per second.

Other sectors battle publicly with data and security breaches. Financial institutions quietly go about their business. Behind the scenes decades of protective monitoring, threat detection and active defence is being used to keep our money secure. We all understand the term “bank grade security”. Fraud continues to grow in scale and volume. Though we know this due to the ability of banks to track it. More often than not, fraudsters target the weak spot of the customer.

The days of the bank manager being on first name terms with each customer are a sepia-tinged memory. Yet the process of proving a customer’s identity is stronger than ever. Banks have migrated customers from physical branches to online and mobile interactions. Their investment in remote identity verification has matched this shift to digital.

To combat ever-growing threats, banks are increasingly regulated. They need to prevent identity theft, terrorist financing and money-laundering. Know Your Customer (KYC) obligations put identity at the core of what financial institutions do day-in, day-out. Banks are full of clever people. They are challenged with staying one step ahead of the bad guys.

This means that banks make ideal candidates to be an identity provider. They have a unique combination of security, protection, trust, and performance. Add in their customer digital experience, data management, and KYC. They’re also part of the national infrastructure. Surely it stands to reason that the future of identity provision will come from banks.

The challenge comes when identity and entitlement are more distinctly understood. KYC and the required Customer Due Diligence (CDD) effectively breaks into three component parts:

Who the customer is (identity)
Can you do business with the customer (entitlement)
Should you do business with the customer (entitlement)

For banks, a trustworthy identity is a means of establishing entitlement. Banks operate to the same set of national regulations. Though their risk appetite and commercial imperatives drive their approach to identity. This is much more nuanced than under a standards-based identity scheme.

Some start-up or challenger banks see their onboarding process as being a competitive advantage. When you’re building a business converting every potential customer into an actual customer results in different priorities. A layered approach to Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) controls can be taken. This enables a weaker upfront identity checks. Checks are strengthened on demand as risk markers are triggered.

There is also the product suitability dimension. For a pre-payment card, the risk and controls for on-boarding a customer differ greatly from an unsecured loan. And an unsecured loan for £500 similarly differs from one for £20,000. A mortgage could be for £2m, though the risk is less because there are land, bricks and mortar to offset against.

Then there are those customers whose bank accounts were opened with nothing more than a handshake from their friendly local bank manager. The standard of KYC across the bank’s customer base varies depending on the process at the time that they became a customer. It varies with the products they’ve taken since. And with the level of interaction they’ve had as banking has transformed.

Throw in a commercial opportunity and KYC becomes even more fragmented. For example, in the UK market there is one High Street brand that foreign nationals go to ahead of the others. Do they have the best product? Probably not. What they do have is the easiest on-boarding process for new to country customers. Five or six years ago, another High Street giant dominated service for this demographic. Their risk appetite changed and the commercial advantage was sacrificed in exchange for tighter controls.

When the result of identity verification impacts on your commercial performance this changes your approach. Obviously skirting on the right side of the regulatory line.

There are also the 1.5 million people in the UK who are unbanked. How do we ensure that as well as being financially excluded, these people don’t also become identity excluded?

With so many variables at play, the idea of a “portable KYC” is challenging to the point of being improbable. There will be impacts on being able to leverage portability that can be used across sectors. It will increase scrutiny, tighten regulations and impose new standards on banks. Imagine the exercise required for a bank with millions of customers to bring all those accounts up to the same standard of identity verification.

Should banks be identity providers? Absolutely. If they wish to. And if they understand what impact it will have on their business. In a mature commercial environment for identity, some banks will play a valuable role as provider. Others will input requirements, expertise and use case demand. And that environment will be right for everyone.

Read my other posts
Check out my other posts https://no1ba.blogspot.com

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has over 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

My convenience, your security

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 20 Aug 2018 17:23:00 +0000

Last week there was fraud event with my credit card. Fortunately, my card company spotted the attempted fraud and blocked any transactions – so no hassle arguing over money. What it did mean however was that I was stranded, away from home, with no credit card to pay for my return train tickets. Throughout the entire experience, security was a distant thought; all I cared about was (in)convenience.

Having been notified about the attempted fraud, it took me 24 hours to actually contact my card company. This wasn’t because I was on top of a mountain with no phone coverage – or that I’d been held captive by the fraudsters - the simple truth is that I wasn’t that bothered. It was so low down my list of priorities that it disappeared from day one’s task list, and on day two I forced myself to do it first thing otherwise I knew it would drop off again. I didn’t know how serious the attempted fraud was – was it a half-assed attempt on an online payment, had they tried to access my account using my personal details? I still don’t know exactly what happened, “security reasons” mean that I don’t get to know the what, why and where. This lack of involvement is definitely one of the reasons why I see the problem as my card companies, not mine; and why I care more for my convenience than their security.

When on the phone, I went through the usual knowledge-based authentication. What’s my favourite colour of dog? What month was my rabbit born? The usual process that leaves me feeling cold when there are much more modern ways of secure communication. Hey, is it any wonder that you’re having to deal with your fraudsters with legacy security processes? They satisfied themselves that it wasn’t me who’d tried to buy a Gucci handbag from a website in Guatemala or whatever had occurred. Now they’d cancel my old card and strap a new one to a homing tortoise. What? Cancel my card? I need it! I can’t wait for you to send me a new one. Obviously, I was terribly sad to hear of their security problems, not sad enough that to solve it they’d have to inconvenience me. After much grumbling, and telling me repeatedly that there was no choice other than cancel the old one,

they eventually agreed to at least deploy the new one via homing cheetah instead.

After hitch-hiking back home, spending another day grumbling about the inconvenience of it all, my new card arrived. Security as the top concern, my card company has sent this using a signed for service. So obviously the delivery person had scribbled on their pad themselves and left it securely propped up by my front door. Convenient for them, convenient for me. Not so secure for my card company.

Now those who know me, will be surprised that I’ve been talking about a credit card; I don’t actually use the card. I use Apple Pay. This was my next point of inconvenience, having to set up my card on my phone and watch. Except that it wasn’t inconvenient at all. It was either witchcraft or some sort of data sharing between my card provider and Apple. When I selected to add a new payment card to my wallet I was asked if it was the card ending in the last 4 digits that my card provider had sent me. Instantly I forgot about GDPR and informed consent and personal data. This was convenient… and kind of cool.

Sadly, not everyone accepts Apple Pay – though happily, for convenience again, I can usually save my payment details with the service providers that I use regularly. One such provider is the App where I buy my train tickets from. Now this App is absolutely awful. It looks like the train company asked their office cleaner to develop it for them. And high on the fumes of Vim mixed with Bleach the cleaner agreed to do this despite not having any of the skills required to do so. Yet using it means that I have access to eTickets. No print at home or collect from the station for me – eTickets all the way… convenient. Given how awful I said the development of the App is, I don’t really have great confidence in how secure it is either.

If I was a betting man, I’d guess that the fraud on my card was more likely to have come from the train company that Apple. Though I also know that I’m using my card as designed when I fill them in and when I click the button to save for future use. If the card company doesn’t use the best security, then it would appear that neither of us are that bothered. Maybe convenience is best for both of us. My new card details are now in the place where the old ones were. The same pattern repeated across all my regular interactions.

Unless my card company changes to show me that security is important to them, and educates that security is important to me – mutual authentication as a minimum for communication regardless of channel, tokenisation and identity in payments, customer centric fraud prevention – then convenience will remain my priority and security will remain their problem.

Read my other posts
Check out my other posts https://no1ba.blogspot.com

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has over 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Privacy is not dead

noreply@blogger.com (Bryn Robinson-Morgan) — Sat, 02 Jun 2018 13:00:00 +0000

The implementation of the European Union’s General Data Protection Regulation has raised the profile of where our data exists and how our data is used. This has led to many discussions on the concept of privacy, and for many to declare that privacy is dead.

It’s true to say that our data is far more freely available than it has ever been. The advent of social media created a willingness, even a desire, for people to share their activities, their thoughts, their feelings. Facebook changed the concept of friendship – The average Facebook user has around 350 “friends” who they share their lives with.

Whilst our data has been made available via public registers – the electoral roll, telephone directories and all – the digitisation of this information onto the internet brought convenience and searchability for anyone wanting to find out information about us. Our sharing of information via social media added depth and meaning to our data.

With so much information about our lives available and easily accessible, it is surely fair to assume that privacy is dead. My assertion is that privacy isn’t dead, it’s just misunderstood.

Given that I gave social media is a cause, I’ll provide balance by using it as to why privacy still matters. When the world’s largest data business, Google, tried to move into social media they understood privacy. Their implementation was based on the fact that we have circles of privacy. The idea that I share different information about me with different circles of people. The Venn diagram of privacy where context is key.

Within GDPR, the processing of sensitive personal data contains a derogation for personal data which are manifestly made public by the data subject. This doesn’t mean that because the data has been made available it is a free-for-all for whoever wishes to use it. We have to consider the context for which it has been made available.

When we consider privacy, this shouldn’t be on the basis of what information is available, or where it exists. We need to look at privacy from the perspective of the user. If I shared what I got up to on the weekend with my immediate family circle I haven’t given away my right to privacy. This information, whilst maybe more accessible and more public than at any time in history, doesn’t make it any less private. Privacy wasn’t dead when the first phone book was published, so why should it be now?

The new paradigm for privacy is looking at information hidden in plain sight; protected by context. This may mean that we have to consider how we authenticate and verify our customers. Knowledge based challenges are worthless where the information is available to fraudsters who don’t operate by the same rules of privacy. The value of static data for this purpose has diminished.

When we understand this new paradigm, we can design for it. Understanding enables us to better authenticate and verify our users. It allows us to put users back in control of their data. It allows us to innovate around how users can earn value from their data.

Privacy isn’t dead; it’s just misunderstood.

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
Trust me, I know a shortcut - Digital identity is hard. Take shortcuts at your own risk
The rise of synthetic identity - Fraudsters are playing the long game, we need to think ahead
Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity
Privacy is not dead - Understanding the new paradigm of privacy

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn over 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Let's get physical

noreply@blogger.com (Bryn Robinson-Morgan) — Fri, 23 Feb 2018 17:15:00 +0000

2018 sees the first wave of “adults” born after the millennium – those who have grown up in the digital revolution for who technology and online are mundane, every day things, rather than something to marvel at. As the “silver surfers” begin to make way for the generation for whom life before Facebook simply doesn’t exist – what relevance will the physical world play within the new digital age?

The good news is, that we’re not yet ready to be all be plugged into the Matrix and live our existence inside a virtual reality. In the world of retail, despite the rise of convenient online shopping, almost 85% of sales are undertaken in a physical store. The social experience of shopping is still something that people want to experience in the physical world. What we’re beginning to see in this sector is that online and in-store working together in tandem. Successful retailers are joining up these two channels into a holistic customer experience. The so-called “bricks and clicks” environment is thriving because people still value what a physical store brings.

The following roles of a physical interaction are still incredibly important:

Exchange
Personalisation
Technology gap
Accessibility
Security
Trust

Exchange

As we’re not all plugged into the Matrix, we still need physical things. Some of these are “legacy” items such as documents that have not yet been digitised (Passports, Driving Licences, Certificates et al) whilst others are things that it’s unlikely they ever will (food, clothes, etc.). Almost every frequent online shopper has experienced goods not being as described, or even fraud from untraceable sellers. Trust in the physical world it seems still outshines that of the online environment. Whilst many things are now shipped, often in incredibly quick timescales – with the promise of drones cutting it even more dramatically - we still have the need for a physical location for many of the things that make our life easier. If you’re in the middle of doing something, the immediacy of the local shop is still hard to replicate for convenience.

Whether the exchange of a physical item is through shipping, self-service, or click and collect, we still need a physical experience for our online journey.

Personalisation

When you go to the supermarket for your groceries how often do you pick from the front of the shelf, or randomly dip into the apples? The buying decision has so many dimensions, what the expiry date is, how shiny the apple is, whether the tin is slightly dented, how much fat is on the steak. These considerations extend to a greater or lesser extent into other domains too. Replicating personalisation online is hugely tricky without compromising on the reality of the customer experience. It may be my vanity in believing that I look just like the model photographed wearing the clothes on the website. When I buy clothes online it often results in incredible disappointment when the item finally arrives and I try it on at home.

Whilst many online interactions don't have a physical element, for those that do this still needs to occur somewhere in the customer journey. Where personalisation is low, the physical interaction can happen successfully at the end. Where personalisation is increased, the physical interaction needs to move further forward in the overall experience.

Technology lag

The term smartphone is probably an outdated one. Of all the things we do with these devices, using it as a phone is probably low down (and decreasing) as a percentage of time spent interacting with it. Things that we may have done previously, such as getting a passport quality photo, the little device in our pocket can now do entirely online. No longer do we need to go to a physical location. The issue is that technology often follows a well-trodden path. The camera in a mid-priced smart device delivers the same quality photos as an expensive, bulky camera would have 5-10 years ago. Yet there is still a market for expensive, bulky cameras because they’re now as good as the cameras in smart devices will be in another 5-10 years’ time.

Why we should care about physical from a technology perspective is similar to why we should care about Formula One. The innovation in the car industry starts off as expensive, vanity, over-engineered non-sense to make the F1 car a 100^th of a second faster. It then gets productionised into top end vehicles before becoming a commodity item on every car.

We should remember that technology doesn’t stop. The generation who laughed at their elders trying to use the gramophone, will have been laughed at themselves as they tried to use the Betamax. And they will have been laughed at trying to use the iPod. And they will have been laughed at trying to stream a movie. Technology will always be confusing at some point in our lives. When it reaches that stage it's less likely that we'll be interested in owning it ourselves.

Accessibility

The knock-on impact of technology lag is accessibility. When you need to be able to take a 3D photo to get a passport, this may have only made its way into the latest high end smart device. Ubiquity needs to be delivered elsewhere.

The availability of technology is only one part of the accessibility issue. Competence is a major issue too. Being able to use the internet is one thing. Being able to complete a complex application form is another.

Accessibility covers broad demographic and use cases, depending on what the need is. When making a recent application myself, the requirement to “get someone to witness your signature who has known you for at least 5 years and isn’t a family member” caused me a considerable inconvenience. In the digitally connected world many of my closest friends live the furthest from me.

Security

We’ve all seen the keyboard warrior. The person who has a strong opinion and isn’t afraid to use the caps lock to GET THEIR POINT ACROSS. Or the troll who sends offensive, abusive, threatening or persistent messages to one or many people. There are two things that you can do (fairly easily) online that you can’t do (easily) in person. One is that you can walk away unbruised. The second is the volume in respect of effort. If I wanted to shoplift a £1 item to make £1,000, doing that in person means I’ve got to go around a lot of shops and I my risk of getting caught is huge.

I can spam several thousand people online in minutes, to get them to put money into an anonymous account in return for something that I don’t deliver on.

We see the impact of this today with people “washing” fake documents through online document checkers in order to prioritise where to use them. Walking into a physical location where the risk of apprehension of both the document and the individual is far riskier.

Doing things offline doesn't necessarily mean they're more secure - often its the opposite. However they are different. The risks change. The controls change. The mitigations change. Using the right channel to get the right experience with the right security is how we get the right result.

Trust

When things do go wrong online, having a physical location to go to is often the only way of unpicking the situation and restoring the balance in the force. This brings together many of the points raised so far. It may be simply returning an item ordered online where I need to prove that the item was faulty. Or it may be having to demonstrate a high level of security that simply cannot be achieved online. Trust in the digital era is about having great experiences in both the online and offline worlds.

Getting in physical shape

In the financial sector, the advent of open banking will see the market opened up to more tech and online focussed services that those with an estate of retail outlets will have to compete against. In order to do so, there is a need to focus on the services that customers value online and in store. Ensuring that the online offer is as good as or better than the competition becomes the baseline. The advantage comes from bringing the benefits of the retail network to complement this.

Thinking about the physical world isn’t about reverting to legacy ways of doing things. The sepia tinted glasses of how great things were back in the day isn’t the way to view how to operate. We should be making the right use of the offline and online channels to create a joined-up customer experience. This will deliver a sustainable, relevant and valued bricks and clicks offering. So, let’s get physically fit for the digital era.

Trust me, I know a shortcut

noreply@blogger.com (Bryn Robinson-Morgan) — Thu, 09 Nov 2017 13:24:00 +0000

One of the greatest digital innovations of recent times is the SatNav. When Satellite Navigation was first introduced to the motoring public, it was a custom device, with a custom map downloaded to it. This handy device allowed you to plan your route to a fixed set of destinations with turn-by-turn instructions to get you there safely. The biggest impact it had in the early days was that no longer did you have to argue with your passenger when you got lost; you could now argue with a machine instead.

Yet it is the digital age where SatNav’s have been taken to another level. The accessibility of the smartphone and communications networks gave it a platform; driven by the data economy it discovered an entirely new business model. Whereas once a new road or change in layout would’ve required you to wait for the next annual map pack; and a traffic jam would’ve been something to drive into – using real-time data from the users of SatNav your arrival time is based on current information, constantly updated along your journey, to get you there as expediently as possible.

Whilst the opportunities to show that man still better than machine have dwindled – currently, even the best SatNav in the world is no match for a little local knowledge, mixed with eyes on the ground and the ability to push the boundary of the highway code right to the edge. If there are five cars ahead at the lights, the SatNav still doesn’t know to take a left, do a u-turn at the next junction and hop across number 38’s flower bed; a route that doesn’t exist on any map.

Where this becomes an issue is when you’re the passenger rather than the driver. There are two things that erode trust. The first is when the car starts taking on water because the river on your shortcut was deeper than expected. The second is when the arrival time goes up. And it seems that once you’ve eroded that trust it doesn’t matter how excited you become that you can save 26 seconds on the journey time – the SatNav’s instruction becomes more credible than your own.

In the world of identity, this erosion of trust is often expensive, and sometimes fatal to a scheme. The Estonian Government are busy re-issuing their identity cards after a theoretical security flaw was found. Fortunately, they acted swiftly to restrict access to services. One benefit that Estonia have with their identity scheme is that it is mandatory; so whilst a costly and embarrassing episode for them – the inconvenience to the customer is unlikely to lead to a public revolt against their much vaunted service.

Estonia have always had an enviable position when it comes to digital government, and how they have designed and implemented their digital identity scheme to support it. Being able design services and architecture from the ground upwards, and mandating some of the more awkward parts of the identity solution (physical step out for example) upon the population have helped them to grow adoption at a rapid pace. In other countries, how services are accessed comes with choice, and digital identity is optional rather than mandated. These countries have to create compelling reasons for their citizens to engage with digital government.

Similar considerations exist in the private sector – the sweet spot of security, user experience and cost needs to be hit. If you don’t hit this you won’t create a service that users want to engage with. Digital identity is hard. How we can reliably identify customers in the digital era when identity is based on legacy physical constructs is always going to grate against customer experience. The data, systems and services that we need to leverage are going to be costly.

It may be tempting to take shortcuts on security in order to minimize costs and maximize customer experience though we have to consider how easily trust can be eroded when we get it wrong. Customers understand that checks and hurdles are intended to keep them safe, and they expect them. Though they don’t expect to be put through the mill for access to a service that doesn’t warrant it.

Identity fraud is a growing problem, whether in the context as a citizen of a government, or a customer of a private sector organisation. We shouldn’t take shortcuts on identity unless we’re confident that the outcome is going to be better than following the route our more conservative security conscience us tells us that we should. If your digital identity experience seems too easy, the chances are that you’ve taken shortcuts in either cost or security. It may work for you in the short term, though eventually you’ll run out of luck. The challenge is how to avoid being the one flapping their arms wildly because you know a shortcut – and realising why everyone else is ignoring you.

Read my other posts

The rise of synthetic identity - Fraudsters are playing the long game, we need to think ahead
Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

The rise of synthetic identity

noreply@blogger.com (Bryn Robinson-Morgan) — Sat, 23 Sep 2017 13:02:00 +0000

In an increasingly digital world, we’re constantly being hamstrung by analogue thinking. As individuals, our data has been given away quite freely by governments and organisations. It would seem a huge invasion of our privacy if our mobile phone provider told anyone who wanted to know our personal information without any checks and balances being in place. Yet for years our fixed line provider published huge paper directories with our names, addresses and telephone numbers; and governments happily share our personal details through electoral and other public registers.

In the digital age, this becomes a huge problem. The ability to link disparate data sets together to create a rich picture of our identity makes us vulnerable to fraud. Add to this data breaches that spew further details of our lives. The response is to tell us to change our password, or cancel our credit cards. Whilst we can fairly easily change these attributes that create links to us, we can’t change the fundamental core of our existence.

Synthetic identity, the process of amalgamating fake information with real identity data, is today involved in 80% of all credit card fraud. The true scale of the problem is likely to be far greater as fraudsters are happy to play the long game. The effort involved in creating and growing a synthetic identity is relatively little, because of the data that is available. Taking information that is in the public domain, linking it with information that shouldn’t be – either from data breaches, phishing scams, or careless social media postings – isn’t sophisticated. The same technology that organisations use in their CRM systems allow fraudsters to link this to create a “good enough” essence of identity from which to grow their synthetic version of a real-world entity.

For example, social media companies don’t offer much in the way of a barriers to their customers creating a profile. An email and password is a fairly standard way to get started. From this, real world identity attributes can be linked. In a couple of minutes I can be anyone I want to be. At this point, I’ve done nothing illegal (I may have breached the T&Cs) though if I know the real-world identity I’m targeting, I can lay the first foundations of my synthetic identity. If I know where my target lives, I can even use a VPN to link the social media profile to the right location.

With bot technology, my social media profile can happily go off and make friends, have opinions, and most importantly build lineage of my synthetic identity. Depending on how successful my bot is at making friends, and how much other data I can link to it from real identity information, I can start to do other more interesting things. I might for example want to get pre-pay mobile SIM. For a few bucks I can use my social media profile to get a mobile number to associate to my synthetic identity. I have now built a footprint that others trust. A few messages from my mobile, and I can decide that it’s time for my synthetic identity to get a credit footprint. Migrating from pre-pay to post-pay is unlikely to trigger any fraud alerts – real people do it every day.

Of course, at this point we do have controls. Post-pay means credit, and credit means regulation. As my synthetic identity isn’t real, here’s where it will fall down. The credit check will fail – and a handy marker will be raised against it. So now my synthetic identity has a credit file too. More applications, more failures, more footprint. Now I can apply to the credit card companies who are designed for people just like my synthetic identity. “Poor or no credit rating? Minimal identity footprint? No problem.” Sound familiar?

At some point the fraudster needs to make money. Today, we can see that credit card fraud is where the burst-out moment comes. Take the cards, max the limits, burn the identity. Yet what we don’t know is how many other identities are still being percolated. The fraudsters may be using their synthetic identities to make phone calls with their mobile and buy things with their credit cards; paying their bills off each month like model credit citizens.

The good news is that all the organisations mentioned above, and many more besides, are tackling this problem. Technology, processes and controls are continually evolving ways of spotting the synthetic identities amongst the real ones. This will always be an ongoing battle. The other issue to address, is to bring about standards and interoperability for identity across these different nation, sector and organisational boundaries.

There will always be varying requirements for identity. What I need to prove, and how much assurance is required in order to post a photo of what I had for dinner varies greatly from the requirements for me to walk into the cockpit of the plane. Where standards are invaluable, is that the reliance placed upon a low-level process and the increment to a higher-level of assurance are understood, controlled and properly mitigated. If all parties adhere to interoperable standards we can have progressive assurance of identity.

Too often, the “not invented here” attitude, or competitive advantage through a lower assurance standards serve to undermine the entire system. Standards that allow for innovation must become the benchmark for organisations whose data is trusted by others within the marketplace. As digital identity schemes become more prevalent there is an opportunity to evolve away from the analogue processes that blight the digital world. A collective and collaborative push is required to accelerate the rate of adoption. If we’re to prevent fraudsters targeting the weaknesses, we need to have collective responsibility to drive standards upwards.

The digital age allows fraudsters to play the long game – we need to think ahead.

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
Trust me, I know a shortcut - Digital identity is hard. Take shortcuts at your own risk
Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Just in case

noreply@blogger.com (Bryn Robinson-Morgan) — Tue, 11 Jul 2017 17:37:00 +0000

From early adoption to maturity

Around 15 years ago, my mother asked what I wanted for Christmas. My answer was a new wallet (please) and my requirement was that it had to have plenty of slots for cards. This was in the boom years for store loyalty cards and credit card companies bribing you with gifts and incentives for singing up and using their cards. At a guess, I’d say that my wallet contained over 20 different cards at any one time. Fast forward to today and my wallet has 3 cards and a driving licence in it; and far less cash than I used to carry around. Yet I have more store cards than you can imagine - a full sweep of supermarkets, varying qualities of chicken and burgers, purveyors of camping equipment (used once every ten years on average), sports centres, airport lounge passes, airlines, et al – though now they’re virtual, in my digital wallet.

As a relatively early adopter of technology, I don’t want a wallet for Christmas. In fact, I don’t want a wallet at all. My payment method of choice is my watch (smartphone payments are so 2016!). So why do I still carry my wallet with me? Well, mainly, the answer is “just in case”. For those annoying times when shops either don’t accept new money at all or insist that under a certain amount I have to pay with metal or polymer like they did back in the day. It seems that no matter how I explain that the percentage charge for credit card transactions is less than they’ll spend on cash handling some shops still haven’t moved with the times. Whilst I have been known to make my evening meal choice based on payment method rather than cuisine, I haven’t quite reached the point of boycotting all providers who don’t allow me to flash my watch at them.

Yet it isn’t just the merchants who cause me to carry my wallet with me “just in case”. You see my watch likes to behave like a child who has been dragged away from the chocolate at the counter and sometimes has a tantrum – either not working at all or asking me to try again later; of course I don’t mind coming back to re-do my shopping at a time my watch finds more convenient. Sometimes I can flip back to 2016 and use my smartphone to pay, other times I have to fish my wallet out, put my card in to the slot and try and remember the random number; occasionally it’s good to reminisce about how my parents paid for things when they were my age.

Of course, it isn’t just payments and retail. The other thing in my wallet is my driving licence. Now admittedly, it’s been a few years since anyone has asked me whether I’m old enough to buy alcohol without laughing; though I have been asked to prove my identity when taking out credit agreements when having my driving licence has been really handy. Though of course driving licences aren’t identity documents, they show my entitlement to drive.

Which brings me on to another just in case moment – the UK National Identity card. Whilst it never got as far as full rollout, the pilot programme issued real cards to real people, and allowed them to do real things – such as use their card instead of their passport to travel within the EU. I remember standing in Birmingham Airport, with a passport hidden in my back pocket, with the good folk at boarder control crowded round a PC screen whilst I showed them the government website and explained how it all worked. Whilst I was prepared to hold my nerve for a while, faced with being right and not on the plane or pulling out the just in case passport and being on the plane, I would have gone for the latter option.

As you can imagine, when the Driver and Vehicle Licensing Agency (DVLA) announced that they will roll out a version of your licence on your smartphone and the UAE started allowing passengers at Dubai to use their smart-wallet passport to cross its border, I was rather excited that my wallet was moving one step further towards being consigned to history – much like my DVD collection.

The pace of innovation will always be constrained by uptake, adoption, prevalence, ubiquity and reliability. For early adopters, the need to have a back-up – just in case – will always remain; the challenge for innovators is to reduce the time taken to move into the mainstream. Having spent 15 years winding down on my wallet dependence I am well aware just how long things will take. I really hope that in another 15 years I won’t have to carry my driving licence with me – or better still than what’s on my smart-wallet will be my driving licence rather than just a version of it. And that my passport doesn’t have to come on holiday with me in my back pocket just in case.

As we move towards reliable, trusted, digital identities – our entitlements, such as payments, driving licences and passports, should be asserted digitally regardless as to whether we are using them in an online or physical channel. The cost savings, fraud reduction and improved customer experience will be immense.

And my biggest wish, is that my DVD collection doesn’t fall through the creaking roof from the loft where I’ve stored them in preference for streaming. And why I have stored them? Well you know, just in case.

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

I have control

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 17 Apr 2017 17:06:00 +0000

Can we truly own our identity?

Digital identity is a complex subject; as with most digital transformations, taking a process that exists in an analogue world and digitising it for use online doesn’t create a great solution. A number of models for digital identity exist, and are often spoken about in terms such as centralised, federated, distributed, user-centric, self-sovereign. There are countless papers by the great and the good of the identity world that talk about the merits and flaws of the varying models. There’s a school of thought that centralised is bad and self-sovereign is the panacea for digital identity – though often these ideas focus too much on the model and less about the use. And the arguments are often mired in digitisation of analogue.

Self-sovereign digital identity is a model which:

Places the individual in absolute control of the digital representation of themselves
Is based upon the kernel of self that exists in the real world
Assures the individual of access to all the data regarding them and provides transparency of how data flows
Persists for as long or as short as the individual decides
Assures portability and interoperability
Functions on explicit user consent
Operates sharing based on principles of data minimisation

These are all traits which it is hard to argue shouldn’t be the foundation of any digital identity model – never one to shy away from an argument, here goes:

Places the individual in absolute control of the digital representation of themselves

Until such time as we plug in to the matrix, a digital identity and the flesh and bone which it represents cannot be linked with absolute certainty. When the link between the two is, or is reasonably believed to be broken, control of the digital identity must be revoked (either permanently or temporarily). This introduces a higher power of control over the individual’s identity.

Is based upon the kernel of self that exists in the real world

Identity in the real world is also complicated. In the real world, our identities are often assigned by central authorities such as governments; or they’re guaranteed by 3^rd parties such as our parents; or they’re accepted based upon assigned attributes such as name, address and date of birth; or they’re based upon our DNA. And more often than not, they’re a combination of all of these. If our digital identity is based upon our real-world identity it cannot be self-sovereign.

Assures the individual of access to all the data regarding them and provides transparency of how data flows

We should always strive towards openness and honesty. Yet there are circumstances where we need to keep data hidden and circumstances where its beneficial for the user to do so. As an example, the organisation who will rely on digital identity are often required to check for fraud and criminality against our identity. This isn’t information that we should give to the user, yet it is often closely tied to their identity. So commercially and practically it needs to flow with the identity assertion. When we give information to an individual, we also have a duty of care not just when that data isn’t correct, yet also when that information risks disenfranchising the individual. Credit scores used to be information passed from Agency to Supplier about the individual without their involvement. This changed, and in the last 20 years, they have gone from information that we know, to information that we can actually manage. Yet for many people, a poor credit score creates exclusion – which leads to disenfranchisement. If digital identity is to be inclusive, the data that we give back to the individual needs to have the duty of care built in. We should work towards openness, we shouldn’t dive straight into it without understanding the consequences.

Persists for as long or as short as the individual decides

For some nations, having a government issued identity card is mandatory, for others it is optional or simply doesn’t exist. Rather than eulogising on which is right, digital identity needs to recognise all models do and will exist, and look to provide a digital identity model which supports mandatory and optional membership of government registers. Similarly, fraud systems need to persist identity elements to protect from bad actors. We can offer choice in how long our digital identity as a “thing” persists, on the data that makes it up we can’t.

Assures portability and interoperability

Data portability is a convenience factor that shouldn’t be wilfully restricted. Identity portability is where the value and complexity lies. In order to drive the market, the work done in proofing the identity and attribute claims can’t simply be ported from one party to another. To do so risks separation of effort and reward, which disincentives the commercial efforts required to develop and maintain a functioning marketplace.

Interoperability can only be assured with mutual trust. Mutual recognition is reliant on the creation and adoption of interoperable standards. Interoperability of systems should only be required once interoperability of standards is achieved. We shouldn’t expect that everything interoperates with everything else unless everything is equal.

Functions on explicit user consent

The notion that an individual can explicitly permission what data is shared by whom and with whom is reliant on goodwill that doesn’t exist. If we are given the choice to share only positive information and withhold anything negative, this is going to be a common choice. This will restrict the ability for the receiving organisation to rely on the data. Hobson’s choice (take what’s on offer or nothing at all) isn’t explicit consent for data sharing either. We should be far more honest with how we define consent, so that a user understands when we need broad consent to search for good and bad information about their identity and when we’re seeking explicit consent to only share attribute X from organisation Y with organisation Z.

Operates sharing based on principles of data minimisation

Users shouldn’t need to understand the principles of data minimisation. In a self-sovereign model, where they’re free to share their own data as they choose with whomever they choose, they need to understand who they’re sharing their data with and whether they’re only asking for the data they actually need. In other models, such decisions are made on behalf of the user based upon their own rules - for example, the Passport Office can permission that “X holds a valid passport” and “X is a Citizen of country Y” to be shared with anyone that the individual wishes; and that “X has passport number 12345678” only with parties which it trusts – which takes away both the control and the responsibility from the individual.

Self-sovereign identity is a utopia that may never exist based on principles that may be better achieved through other means. We should focus more on the things that a user needs from a digital identity and worry less about the model that we use to achieve them. In designing digital identity, if we do so based on principles the user will value, and deliver them in a way which they will engage, we have the opportunity to revolutionise identity for the digital age. Can we truly own our identity? Does it matter providing we can assert our identity when we need to, to get things done?

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
Just in Case - From early adoption to maturity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Tipping the balance

noreply@blogger.com (Bryn Robinson-Morgan) — Sun, 19 Feb 2017 20:18:00 +0000

Security is often seen as a trade-off for usability – a poor customer experience risks your product being unloved and unused; poor security leaves you at risk of a fine, sanctions, reputational damage or a swift and terminal death of your product, service or organisation. As a product owner usability issues are usually quite tangible. We can see through the users eyes the clumsiness that security measures introduce. Often security is about risk, or intangible issues. Judgements are made on likelihood and impact; we gaze into the crystal ball to imagine what would happen in the event that the security risks come true or the issues are exploited. This crystal ball gazing often results in the wrong balance being struck – which invariably leads to poor outcomes regardless of which side we’ve come down on.

Authentication is one such area of functionality that product owners get badly wrong. As the front door for customers to your product or service, getting authentication right is imperative. Single factor authentication is generally inadequate for anything important and poor implementations of less important access undermine the entire ecosystem. Two factor authentication is often clunky and not user friendly – having to run out of the building to get a mobile phone signal to receive your SMS one-time-passcode, carrying around an authentication token that you have with you at all times apart from when you actually need it, or needing to authenticate into another service to be able to authenticate into the service that you actually want to use.

To get authentication right, context is everything – if we factor in what the user is wishing to do, and combine with behavioural knowledge that we have of the user we can increase both security and usability.

Let’s look at a traditional use case: When I get into my car, I place my smartphone into its cradle and it connects itself, via Bluetooth to my car’s audio system. As I’m driving along, I give a command to the smartphone’s virtual assistant – and recognising my command it says “you’ll have to unlock your phone so I can do that” – which I can’t do… as I’m driving.

Now if we look at the same use case with applied context: my phone is in my car so the chances of someone else using it are less. While I still might not want to open full functionality – I don’t want someone to steal my phone, car and empty my bank account – I can authorise more functionality without the need for any further authentication. I can also use behavioural information to further reduce the security risk – do I normally get my schedule narrated while I’m driving to the station? The introduction of new credential use can be facilitated too – while voice biometrics may not be very reliable in a noisy environment, I can increase the matching tolerance due to the more granular levels of context applied.

This use of multifactor authentication and authorisation allow a much richer balance of security and usability to be achieved. Behavioural biometrics and multifactor authentication could allow product owners to tip the balance in the favour of both usability and security.

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

You don’t know what you’re doing

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 19 Dec 2016 14:26:00 +0000

Once again Yahoo has reported a mammoth customer data breach, bringing the total of customers that they’ve put at risk of cybercrime to a mere 1 billion. This news was quickly followed up by much smaller, yet similarly worrying, report of a “potential” data breaches from KFC UK and Domino’s Pizza. KFC were keen to reassure its customers that it had improved its security measures to ensure it wouldn’t happen again and then provided a handy link to take them to the password reset process – proving that they still know little about keeping their customers safe online.

Cybersecurity is a constant battle to remain one step ahead of the criminals – with the web being inherently insecure due to its annoying insistence on exchanging data with human beings in an unencrypted form – resulting in even the best organisations battling to stay ahead. Incompetent actors within the system are undoubtedly adding to the problem. The same customer information existing in military grade security systems is undermined when it’s also kept in a minimum-security chicken shop.

Too many organisations are using poor practice – even things that have minimal costs to change – and these exist in organisations both large and small – even those with multimillion dollar IT security functions. I recently heard of a large multinational organisation who emailed its staff to tell them they were increasing their security by changing their password policy; with the email containing a link to a deep URL that required the users to first enter their existing username and password. By attempting to increase security they’d actually conditioned their workforce to accept basic phishing attack methods.

A few simple things that we shouldn’t see from any organisation – my 2017 authentication wish list:

Uppercase, lowercase and number requirements: “Password1” is no more secure than “password”, as that’s what this policy results in most users doing.
Your password is too long: No, your field length is too small.
Your password has expired and must be changed: making me change my password, makes me forget my password, makes me reset my password, creates an unnecessary weak point.
Your password is too similar to your previous one: how do you know? Oh that’s right you use my password unencrypted so you know throughout your system what it is and creates opportunities for others to steal it. Hash it when I first give it you and compare the hash when I assert it in future.
Here’s an email with your password: Just no.
Here’s an email with a link to change/recover your password: See above.
Sorry we don’t support 2^nd Factor authentication: Use a federated service that does.
Sorry we don’t support keychain / password management services: Get better developers who know how to integrate them.

Fortunately, there are organisations who operate good practice – with many of them offering federated services that can be consumed securely by other organisations. Whilst governments and regulators are encouraging consumer choice and market competition they’ve been slow to enforce standards for keeping customers safe. As data and systems are exposed using open APIs for the good of the consumer we need to ensure that we have proportionate controls for the organisations seeking to use them. PSD2 may make it easier for my fast food company of choice to take payment, yet as it seems we can’t trust them with my password how can we trust them with access to my finances?

Under GDPR the Information Commissioner has greater powers to punish companies who play fast and loose – which will hopefully encourage those who currently operate poor cybersecurity to stick to what they’re good and leave customer data management, authentication and payment processing to others who do. We need continually evolving standards for treatment of customer data that encourage limits of liability for those who apply them, and proactive measures against those who don’t so that they’re stopped from undermining the entire system.

It would be great to find out, before my data has gone missing, who the organisations are who don’t know what they’re doing.

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

I didn’t say you could touch me

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 21 Nov 2016 22:43:00 +0000

The use of biometrics in user authentication is thriving with fingerprint sensors becoming more common and technology evolving for reliable facial and voice recognition being used within apps. Next generation smartphones may also contain iris scanning capability thanks to micro form factor components that can be included in the existing footprint. This convenience is driving a wave of innovation in how organisations identify their customers. As with any trend, a flood of ideas is generated - with associated risks too.

Over the past month I have heard several industry speakers explain how they’ll use these on-device biometric capabilities to verify the identity of new customers. Which brings the first misunderstanding which can be quickly addressed; unless you have an established link between the biometric and the identity, you can’t verify your customer. Facial recognition offers opportunities of comparison against the established physical identity documents, such as passport or driving licence. Though this is nothing new and the quality issues with this are on validating the document and getting a sufficient quality image of the printed photo.

There’s no commercial source of verified voice biometrics, so there is nothing to compare against. And whilst some physical documents contain fingerprint samples, the ability to access these presents a major hurdle without additional hardware. The other issue with a fingerprint is that sensors used in smartphones don’t present the fingerprint for comparison. The device simply signals the authentication has occurred. The case may likely be the same for other on-device biometric authentications.

Which brings us onto another risk with authentication on a multipurpose device based credential. The iPhone allows up to five fingerprints to be registered and used to authenticate using TouchID. I can choose to take prints of my thumb and four fingers from one hand; digits from both hands; or I can register the fingers of myself and four friends; in fact, which digits, from which hands and from which people is entirely my choice. Authorising others to unlock my phone doesn’t mean that I’m authorising them to sell my car.

Now this is nothing new from any other form of credential. I can authorise you to use my bank card by giving it to you and telling you my PIN. With on-device biometrics I can do the same thing though I need to clearly consent to the activities that I’m authorising. If I normally log into my banking app using a password, they can’t simply enable TouchID authentication without tying the consent back to me first.

Smartphones have revolutionised how we interact digitally with our customers. Biometrics bring a new realm of convenience. Before we start implementation, we need to ensure that we understand the implications and get the design right.

We still need to have robust identification of the customer. We still need explicit consent from that customer. And we need to ensure that their responsibilities should they delegate authority (whether we encourage it or not) are understood and accepted. Getting it wrong will lead to accusations of inappropriate touching; and no one wants that.

Read my other posts

Let's get physical - how to get fit for the digital era by leveraging the offline world
Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

You don’t need to tell me

noreply@blogger.com (Bryn Robinson-Morgan) — Tue, 27 Sep 2016 20:49:00 +0000

In May 2018 the European Union’s General Data Protection Regulations (GDPR) will come into force, replacing the existing Directive 95/46/EC, which will be repealed. The new regulations are seen as an enabling requirement of the European Digital Single Market – removing the current fragmentation of how the existing directive is implemented by member states, and providing legal certainty in particular regard to online activity.

GDPR gives EU citizens significant protection, by placing obligations and responsibilities on data controllers and processors, that are legally enforceable. These regulations don’t just apply to data controllers or processors based in the EU – most larger organisations, globally, who offer goods or services - regardless of whether they charge for them - to EU data subjects will be in scope of the regulations. Many of these organisations will have to appoint a representative who is subject to enforcement procedures in the event of non-compliance.

Over the last few years “Big Data” has been a buzz word in the boardroom, encouraging the collection and analysis of personal data to become core to many company strategies. Often, customer consent has been obtained in a far from transparent way; GDPR seeks to address this by introducing obligations that consent should be freely given, specific, informed and an unambiguous indication of the data subject’s agreement. It also provides protection that personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.

With fines of up to the higher amount of €20m or 4% of a company’s worldwide annual turnover, GDPR is a regulation with teeth. A corporate risk register without compliance to the GDPR on it would be incomplete. And for any organisation that approaches consent by including a line in their terms and conditions, or pre-ticking the consent box, it would be a folly to believe that they have obtained unambiguous agreement. Harvesting data because “it could be useful, or “we might need it in future”, or “we might be able to gain some great insights”, isn’t going to cut it. If you imagine the number of people organisations currently send marketing emails to, because they forgot to untick the box; now compare that to how many people in future would actively chose to be sent weekly offers, you can start to see the scale of impact that GDPR will have.

A post GDPR company, unless they’re a data services company, should wherever possible adopt a data minimisation approach. If data isn’t their thing – then companies should stop gathering it wherever they can. They should take a critical look at every data field they capture and ensure that they can objectively justify it. If the reasons as to why a data item is necessary aren’t clearly justified, then companies should stop capturing it and make plans to remove existing data from their processing systems. They should also look at whether they need the data itself or just the outcome – for example do they need to know someone’s date of birth or just that they meet certain age criteria?

With data minimisation becoming more prevalent, opportunities for companies to provide data services to others become much more valuable proposition; though adequate trust frameworks need to exist. There are two approaches to providing these services. Companies such as Mydex and Digidentity provide a great model of privacy by design, where only the data subject themselves has access to their data in unencrypted form. These companies hold data on behalf of the individual and develop services to allow them to utilise it as a means of monetisation – either paid for by the user or the organisations that they choose to interact with. Consent in this model becomes absolute, as the company themselves don’t define processing or sharing of the data – the power is entirely in the hands of the data subject. There are also opportunities for blockchain solutions that orchestrate connections to storage in database sharding architectures.

The other approach is for companies to become banks for user data. In this model the individual is still in control of their data, though the data service company is able to monetise the user’s data by aggregating it – much like a traditional bank aggregates the deposits of its customers to invest or lend to other customers. The development of services useful to the data subject being the catalyst for them to deposit more data – more money, more interest becomes more data, more services.

GDPR undoubtedly puts the data subject in greater control of their own data, with consent being the core principal. There are also new and strengthened rights for the data subject with the obligation to act upon these rights falling on the data controller or processor. Whilst certain derogations are made for micro, small and medium enterprises, the fundamental regulations apply universally. There are some great summaries of the regulations which every organisation should take the time to read and understand. Unless you’re going to invest the time to read and understand the regulation and impact assess your organisation against it – when it comes to being the controller or processor of personal data, my approach would be to say to your customer “you don’t need to tell me”.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Coming together on being alone

noreply@blogger.com (Bryn Robinson-Morgan) — Thu, 28 Jul 2016 12:52:00 +0000

In case you missed the news - the UK will exit the European Union in the coming years with the aim of gaining sovereign control of the nations future without the interference from the other 27 member states. Whatever your views on the rights or wrongs of this decision - the outlook for the future and the UK’s role on the world stage - one global influence on the UK that is unlikely to alter will be the digital / cyber sphere. Whilst undoubtedly governments can and do moderate the online world’s influence on their citizens, national borders on the world wide web are far harder to control than in the physical world.

A recent celebrity super injunction was challenged in the UK courts on the basis that the information it sought to protect was freely available and easily accessible on the internet for sites hosted and governed by other jurisdictions. When it comes to cyber security, digital identity and online regulation, the larger the physical jurisdiction, the more global influence exists in how the online world operates.

At a recent digital / cyber / identity / security event that I attended, a relatively senior UK civil servant was presenting on behalf of their department’s view of upcoming EU cyber legislation; during the presentation they referenced a meeting earlier that day with the newly appointed cabinet minister for their department on what the opportunities post-Brexit were for the UK in cyber industries. When asked for the outcomes from this topic the response was “I don’t think its appropriate for me to comment on that here”. This was a room full of subject matter exerts from academic, industry and public sector looking for guidance and insight from the UK government - what more appropriate time could there have been to discuss this?

The UK currently plays a leading role in global cyber policy - providing thought leadership, global policy and development of international standards on a range of topics. We simply cannot afford to lose our voice and influence if we’re to achieve the sovereign control that the decision to leave that EU was intended to deliver. That means having strong leadership that gives a clear roadmap on the UK strategy for how we will adopt and interoperate with globally agreed objectives. We simply cannot afford to be inward looking when it comes to the digital world.

The EU has a strategy for the Digital Single Market - so not only will we be negotiating our position in the physical Single Market, we’ll also be negotiating our relationship in the digital one too. One of the key component of this Digital Single Market will be the electronic identification and trust services for electronic transactions in the internal market regulations (otherwise known as eIDAS). The eIDAS regulations aim to enable secure and seamless electronic interactions between businesses, citizens and public authorities with electronic ID (eID) and electronic trust services (eTS). Having a common framework for interoperability that permits cross border transactions is a key building block of the Digital Single Market. The member states transacting in this market have standards based implementation of identity schemes, electronic signatures & seals, delivery services and website authentication. All these electronic trust services will have legal validity within the member states.

In eID, the UK Government have their interoperable eIDAS aligned service GOV.UK Verify - so on the face of it we’ll be able to access the Digital Single Market at least from this perspective; except that along with “the new way to prove who you are online” the GOV.UK platform is still promoting registration to the old way - Government Gateway; even for the services listed under the new way, the old way is still prevalent and often more prominent. So our inward looking approach is already being promoted above the needs of the outward EU interoperable standard.

The answer to what are the opportunities for UK cyber industry post-Brexit are reliant on an updated Government Digital Strategy; we need to know whether we’re going to be more Estonia than North Korea as a nation when we have reclaimed our sovereignty. We need bold leadership that outlines what our ambition is on the global stage; industry needs to know that digital UK has a return available on their investment; academia need to know the skills that future generations will need and they need to know that funding sources aren’t going to be strangled by our unwillingness to operate with a global outlook.

If government can’t control its own departments under a single digital strategy whilst we’re faced with EU regulation being imposed, then what message does this send for our post-Brexit future? We simply cannot afford to go it alone in the digital sphere - our opportunity to provide the thought leadership and influence of innovation, security, regulation and standardisation needs to be increased, not diminished.

The UK Government is embarking in it’s biggest transformation programme ever - my earlier post on why transformation programmes fail, Rip it up and start again, highlights the importance of a clear strategy and vision. In the digital sector we need to know how we plan to come together, otherwise we risk being very alone.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

One Small Step

noreply@blogger.com (Bryn Robinson-Morgan) — Wed, 06 Jul 2016 13:21:00 +0000

The practice of greatness

The Nasa Juno mission arrived safely into its orbit around Jupiter. Nearly five years of travel and over eleven years of planning went into that moment. The culmination of hard work, dedication and brilliance of the Nasa team working towards a single goal: To understand the origin and evolution of Jupiter. Upon receiving the signal from the Juno Spacecraft that its arrival was successful the team rightly celebrated – more memorable quotes entered into space exploration folklore.

"Nasa did it again. That says it all to me. And I'm so happy to be part of the team that did that. I mean this team has worked so hard and we have such great people. And it's almost like a dream coming true right here. The mission team did great. The spacecraft did great. We are looking great. It’s a great day." - Scott Bolton, Juno's principal investigator.

Now for most teams, the goal won’t be quite so grand; the impact not quite as significant. Though should the celebration of success be any less important? Every day when we go to work, we should know what goal we’re working towards – what difference we’re going to make and our how we’re progressing against our target.

Whether your team is working towards a weekly sales target, is managing against key performance indicators or service levels, or is delivering against time, cost and quality metrics, the importance of ensuring that everyone understands the goal and the role they play in achieving it shouldn’t be underestimated. If you’re leading that team you have the responsibility for making it great.

“We did it again” – a great team delivers time after time. Nasa didn’t send Juno off and check back on its progress after 5 years. Every step of the way, every action, every moment was carefully managed by the team – with corrective action being taken whenever required to ensure that the trajectory towards success was maintained.

“I’m so happy to be part of the team” – a great team is a happy team. We all have off days, stressful times, personal problems, work issues. If you or any of your team are unhappy you need to address it and work out a solution. Make sure that your team has the things in their hierarchy of needs to stay happy.

“This team has worked so hard” – hard work needs to be rewarded. Appreciation isn’t just about monetary remuneration – a thank you; a lunch time meal; a trip to the park; a drink after work – reward your team and they’ll reward you.

“We have such great people” – building a great team is much easier if you resource it with great people. Take the time to unlock their potential; recognise their strengths and support them with their weaknesses.

“It's almost like a dream coming true right here” – to make your goal a reality you need to know what success looks like. Make sure everyone knows what is expected from them and let them know how they’re doing against those expectations – do it regularly and often.

“The mission team did great. The spacecraft did great. We are looking great. It’s a great day." – Reaching your goal should be celebrated as a great day. Your great team got you there. Make sure that they look great to themselves and to others. Celebrate your success together and be proud to shout about your achievements.

Your team might not be going boldly where no team has gone before, they might not be changing the world. Though remember, the practice of greatness involves just one small step at a time.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

I not the person I used to be

noreply@blogger.com (Bryn Robinson-Morgan) — Tue, 28 Jun 2016 15:50:00 +0000

Digital identities are set to revolutionise how we transact with business, with governments and with each other. A secure binding of our real world identity to a secure digital token that will allow us to perform trusted transactions online.

At the moment, there is a lot of focus on how we onboard the real world identities and create the initial trusted binding to the digital token. In India, the Aadhaah identity scheme have been creating a national register of identities for over 6 years - collecting the biometrics of over 1 billion residents. In the UK, the GOV.UK Verify scheme has 8 private sector identity providers competing for the enrolment of citizens at the point in time when service provision is required. Norway, Sweden and Canada use Bank issued identity credentials. The different models used are based on national circumstances, customs and practices. Though the common theme is that this initial registration process is a huge commitment for both the identity provider and the end users.

The other area of focus is on authentication; once we’ve bound the real world identity to the digital token, how we allow the end user to assert their ownership time and time again. Credentials range from the humble password, through the convenient if you have it to hand usb key, to mobile apps / codes. With the war on the password recently being stepped up by Google, we’ll start to see biometrics, behaviour and characteristic probability added to the mix.

The biggest challenge though is how to maintain the link between the real world and the digital token. Things in the real world have an annoying habit of changing - so how to keep the digital token in sync whether through genuine change or fraudulent use is an area that needs to be addressed before the hard work of on boarding is corrupted. The monitoring, fraud controls and background rechecks that are sufficient today will be lacking tomorrow as more trust and more services become reliant on the digital identities that exist.

Using authentication to strengthen the binding of the real world identity to the digital token over time is an exciting opportunity. If the identity provider can distinguish to a high degree of probability that I am the one authenticating against my digital token then they no longer need to check against mortality records to ensure that I am still alive in the real world. If they know that I sign in from my home location, they can also confirm to a high degree of probability that my real world address is still valid. The reverse of this is that they can also identify that my digital token may be being used fraudulently, either by me or another party (identity theft).

The propagation and growth of the digital identity market makes the need for more intelligent re-proofing and re-checking back to the real world identity a higher priority than it currently is. Time or frequency based checks that are sufficient today will be reduced to real time verification. Whilst the authentication services may not be sufficiently mature yet (in terms of implementation) to allow our behaviours and characteristics to be used for asserting our identity now is the time to start looking at how they can be used for protecting and verifying the link between our real world identity and the digital representation of it.

There are certainly challenges around privacy and data consent to be addressed - though if we don’t start doing the thinking now we’ll lose the trust and therefore the hard work that went in to establishing the original link. Otherwise, how confident will service providers be in 2 years time that my digital identity is still the person I used to be?

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Rip it up and start again

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 18 Apr 2016 17:51:00 +0000

Business Transformation is a hot subject right now. Boardrooms are buzzing with the latest idea for how to change their business to reduce the bottom line, grow the top line, eliminate waste, increase efficiency, grow deeper relationships with customers. Chief Executives look at their competitors with a jealous eye, thinking how they can implement the industry best practice used by their competitors into their organisation. They believe that others are doing things better than they are... and do you know what? They're right.

Transformation (noun): a marked change in form, nature, or appearance.

For any organisation that is planning a business transformation programme, understanding the meaning of transformation is a good start. Changing the paperclip supplier won't deliver a marked change - even if you're a stationery shop. Transformations are big, they're important, they often require big investment and they often fail!

Audaces fortuna iuvat - Fortune Favours the Bold

Business Transformation programmes are by their very nature a risk for any organisation to undertake. Did I mention that they often fail? Well they do. Often. Fail. Those that do fail usually have one or more of the following characteristics:

They don't set out with a clear strategy for change
They don't set out with a clear vision for the future
They don't have a champion to drive the change through
They don't have board level support
They don't consider the people impact
They don't have support of their people
They don't have a customer strategy
They don't have customer advocacy
They don't see it through
They don't prevent backfill of old ways

So lets pick these off, two at a time.

Strategy and Vision
Firstly, you need to be clear on why you're setting out on your transformation journey. "We'd like to be the uber of..." isn't a great reason for risking the future of your business. If you can't clearly articulate what you want to transform, why you want to transform it, where the transformation will take you, when you'll complete and realise the benefits and how you'll achieve it then stop. Don't go any further. It will only end badly.

Champion with board level support
If you get as far as agreeing your strategy and vision, the next thing that you need is a champion. This is the person who will be carried around aloft when the transformation is successful. This is the saviour of your organisation. Treat them as such. They need the support and authority of the entire organisation. If they don't sit on your board, make a space for them. They need to have equal respect from above and below. They must be a champion in every sense of the word. If you don't have someone to fulfil this role, who will be there from the start to the very end, then stop. Don't go any further. It will only end badly.

It's all about people
With a champion in place, you can then go ahead and look at the people impacts. If the result of your transformation means that you'll have a smaller workforce or day to day roles will change you need to deal with this upfront. Don't make promises you can't keep, don't mislead and don't ignore the feelings of others. This is the most disruptive part of your transformation. Expect it. Manage it. Deal with it. Without the support of the workforce you can't implement effective change. If you haven't dealt with this head on, then stop. Don't go any further. It will only end badly.

Customer strategy and advocacy
A engaged and supportive internal people plan in place then allows you to look outwards to your customers. You can have the most efficient processes in the world, though if your customers no longer want to buy your product you won't last long. Your customer strategy needs to clearly align to your transformation strategy. Do you expect disruption? Will things get worse before they get better? Having someone to represent the voice of the customer at every meeting, there for every decision and making sure that they're listened to as the voice of many is vital. The voice of your customer needs to be just that - they need to get insight, they need to go and test with focus groups. If you don't have advocacy from your customers for your programme, then stop. Don't go any further. It will only end badly.

See it through and move forward
Finally, if you are going ahead you need to see it through. By now you should know that this wasn't a straightforward thing to do. There needs to be realistic expectation and there needs to be contingency within your plans not outside it. If you've ripped the plaster off expect to see a little blood. Sticking another plaster over it takes you back to square one - though this time without any money, support or will. If you're new processes are being replaced by old processes quicker than you can roll them out when you get to the end you'll be back to where you started. This is where you find out whether you picked the right champion. If you grit your teeth and see it through right to the end then you'll see whether your strategy and vision were right.

There's no guarantee of success even if you do everything right - though your chances of success are far higher - and if it's not going to success you should have given up far sooner.

Business Transformation favours the bold - so rip it up and start again.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Distributed Identity Has No Clothes

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 01 Feb 2016 19:32:00 +0000

In January the Government Chief Scientific Advisor, Sir Mark Walport, published a report setting out the findings of a review exploring how distributed ledger technology can revolutionise services, both in government and the private sector. This 88-page report explored a vision of how distributed ledger technology could reshape how government interacts with its citizens.

Whilst the concept of “Identity on the block chain” has been talked about for a while, the seeming endorsement from the Government Office for Science for this idea has triggered the rush for the bandwagon. In the weeks since there have been a number of blog posts saying how block chain technology will solve the problem of how we establish our digital identity, will increase security, will prevent fraud, will either provide gold standard trust or do away with the need for it altogether, will end world hunger, eliminate bureaucracy, give privacy, return control of data to the individual… in fact it will do so many wonderful things we’ll all wonder how we lived before it.

The trouble is, the people forcing their way on the bandwagon often don’t understand block chain technology, or they don’t understand identity, or they don’t understand the problems that they’re claiming putting one onto the other will solve. And here I’ll lay my cards on the table – I’m not a block chain guru; indeed when I blogged about this topic back in August 2015 - Unblocking Digital Identity – my conclusion was inconclusive.

So why then, while every one else fights to grab onto the bandwagon – backed by the Chief Scientific Advisor and other people far more intelligent than I am – am I stood pointing and shouting that the emperor is naked? Well, leaving stupidity aside, there are a few reasons.

Firstly, identity isn’t transactional. When you ask how old I am I tell you my age, I don’t transfer it to you. So if we’re talking about attributes of my identity that can be associated to a transaction – did the supermarket checkout operator get confirmation of my entitlement to buy alcohol? – so this could be written to a distributed ledger as immutable evidence for compliance purposes. Though this is putting supermarket sales on the block chain, not my identity.

Secondly, identity and entitlement often get interlaced. So one of my identity attributes is my date of birth, which when I hit 18 entitled me to buy alcohol (in the UK) – so actually the supermarket isn’t interested in my identity, they’re interested in my entitlement. When claims are made of fraud prevention by putting my identity on the block chain it doesn’t address the fact that people claim things that they’re not entitled to… even when they’re known to the organisation they’re defrauding.

Thirdly, when it comes to security there’s a great comparison to most things in life. The amount of reward to be gained guides the amount of effort we’re prepared to put in. Bad people spend a lot of effort trying to break into bank systems because they know that there’s a lot of reward on offer. And the banks put a lot of effort into protecting their systems because they have a lot to lose. Now if you’re being attacked – the best thing is to know about it – so you can do things to prevent it. If I give you a copy of the identity of every citizen – I tell you what the prize is - and let you take that away and do whatever you want with it – no matter how secure I think it is now, I’m not sure that I feel comfortable in leaving it with you without knowing what you’re doing to it.

Finally, and most importantly, identity isn’t about what was, it’s about what is. People do strange things – like move house, change name, die. So if I verify your identity and write an immutable record of it to the block chain, it is immediately worth less than at the point that I did it. So being able to point to that transaction in 10 year’s time offers very little benefit. If I go to rent a car, the car hire company don’t care that I was given a driving licence 30 years ago, they want to know if it’s still valid now. If I write the event of my marriage to the block chain and have that signed by Government, I can prove that I got married; I can’t prove that I am married unless I go back to Government for them to confirm that I haven’t since got divorced… or died… or that my partner died (which is about their identity, not mine).

Which brings me to the same conclusion as before, though now with much more clarity. Distributed ledger technology will have a role to play in identity – though not in the way that the bandwagon would currently have you believe. What that way is – I don’t know… though I do know it currently has no clothes on.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Bring your own downfall

noreply@blogger.com (Bryn Robinson-Morgan) — Thu, 17 Dec 2015 13:38:00 +0000

The dinner party in the 1970's was the way to show off to your friends how sophisticated you were - treating them to prawn cocktail starters, chicken kiev for the main course and an artic roll for dessert. And of course, you'd also have raided your nearest Marks & Spencer's supermarket for a bottle of their finest generic White Table Wine. You see, back in 1973, you only had a choice from a handful of wines - so it was easy to pick something that no-one would enjoy while at the same time appearing to be the height of the social scene.

Fast forward to the nineties and not only were there hundreds of bottles of wine to choose from, there was also a huge range of beers, spirits and alcopops - something to suit everyones tastes. You'd be faced with spending £30 on a bottle of wine to please the Leadbetters while your other guests would still rather have a beer or some vodka. And so began the rise of "bring your own bottle" - the novel concept of allowing your guests to bring what they would enjoy rather than forcing your taste on them.

The concept of "Bring Your Own" didn't just stop at what drink you'd take to your neighbour's party - it morphed into freedom of choice for the office worker. No longer did employers insist that their workers suffer the 3 year old, previously enjoyed, locked down to the point of being unusable, corporate laptop (often with a range of crumbs and other nastiness trapped in the keyboard); instead they would welcome their staff to the future "bring your own device". Now employees could bring their shinny state-of-the-art Macbook into the office and use it to access the corporate network. No more waiting for half an hour in the morning for the prehistoric corporate laptop to boot up; no more having to close one program down to free up memory to open another. And even better, some employers gave their staff an allowance from the money they saved by not having to give them a work PC.

Yet for some reason, BYOD still remains "the future" at a large number of organisations. Security, inter-operability, tax issues, regulation, health & safety... the list of excuses goes on. Even some of the organisation who allow BYOD wrap so many conditions around it, such as installing software to block or diminish the experience of personal use on your own device, that employees become disenfranchised with the idea.

For the organisations who haven't embraced BYOD there's trouble looming. The next wave of "Bring Your Own" is customer focussed. Bring Your Own Authentication/Credentials/Identity will disrupt how the consumer interacts with business in the digital era. If customers can't remember passwords, they'll chose a different type of credential that works for them... and they'll want to use it with whichever company they chose. If they've proved their age once and now have a verified attribute they'll want to assert it anytime they are required to - regardless of who verified their age and whom they're now asserting it to.

Digital disruption, powered by the ability to bring your own identity, has already started - Chip & PIN, which had a painfully slow global adoption, is already seeing the impact of the digital wallet. Retailers, including Marks & Spencer, have embraced consumer choice for convenience, with banks and card providers often reluctantly falling into line, as their customers reach for their mobile device to authenticate their payments. Portable KYC, identity passports, attribute exchange and federated authentication will gather pace over the next 12-18 months; organisations who are still looking inwards at how they respond to BYOID will lose ground to those who are looking outwards at what role their organisation will play.

Customers will look to convenience, organisations will look towards trust, security and liability, when deciding what identity standards to adopt - the market has a lot of work to do to mash these together. The visionary, customer centric companies, will move towards a risk appropriate framework. One that provides a rewarding experience for their customers.

For those companies who keep looking inwards, if you're still offering your customers the identity experience comparable to White Table Wine in a year's time, you might just bring your own downfall.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

The upstarts at the startups

noreply@blogger.com (Bryn Robinson-Morgan) — Sun, 01 Nov 2015 15:00:00 +0000

Startups disrupting big business is nothing new. It's nearly 40 years since Apple set about changing how technology companies operated yet the difference today is the "unique" way in which Steve Jobs disrupted the status quo is now seen as normal behaviour. There are numerous examples of how Jobs ignored the rules of business and went about doing what he wanted to do, how he wanted to do it. For example the story of Jobs changing the colours of a global behemoth's corporate logo because it didn't fit the colour scheme of his own presentation. If you told that story to the entrepreneurs in one of the many startup workspaces today you'd likely be greeted with lots of blinking, unimpressed faces.

The characteristics of the entrepreneur haven't necessarily changed - its the environment that has. Barriers to getting your idea to market aren't what they were. You can take your great idea, using cloud tech or a mobile platform and go to market with it quicker, easier and more cheaply than ever before. As existing businesses open up their API's, the future of the startup becomes even more of a challenge to the status quo.

Today's entrepreneur can share a ride in an Uber car, to their office for the day that they found on Workspace, find a sofa to surf for the evening on AirBNB - after they've been fed and watered at a collaboration workshop from MeetUp of course. The very way in which Apple began 40 years ago is now a commoditised digital industry that enables more startups to launch more ideas to disrupt more of the status quo more easily.

How existing corporates respond to the changing (changed) landscape in the world of the startup will be key to their own futures. Having your own offices, infrastructure, employees and everything else that comes with being a corporate needs money - and that becomes more of a liability and less of an asset in competing with the startups. Not having a brand reputation for a start-up becomes a positive because they have nothing to lose. A thousand startups can come and go before one lands that disrupts the landscape - yet as the startup itself becomes a disposable commodity, the higher the rate of turnover and the more frequent the disruption.

Corporates who "want to foster the startup culture" often miss the point that they have a brand reputation to look after, that they have enough money to make it worth being sued and that their staff expect to sleep in their own bed not on someone else's sofa. Its not enough just to let someone wear a pair of shorts and a vaguely offensive t-shirt and think that you're acting like a start up.

To stay relevant in 10 years time, big business does need to change. How they embrace the startup culture will vary from organisation to organisation. Some will fund the start-ups, setting up innovation hubs - buying out the good ideas that fit their needs and wishing well those that don't. Some will lessen the bureaucracy that they've constrained themselves with and allow more innovation to thrive from within. Some will radically restructure themselves, becoming lean management, brand and policy units with subsidiaries that are there to make or break.

There will of course be those organisation that batten down the hatches and adopt a protective litigation stance. Though the chances are that those who look to embrace it will stand more chance of being relevant in 10 years time.

The upstart from the startup could also be your boss in 10 years time - so chose wisely who you have sleeping on your sofa!

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Defining the Business Analyst

noreply@blogger.com (Bryn Robinson-Morgan) — Mon, 14 Sep 2015 18:31:00 +0000

The role of the Business Analyst varies from industry to industry, from company to company, from department to department and from individual to individual. Yet there is always a common theme that run through every Business Analyst job description - if you can't find anyone else to do a task, it's a part of the Business Analyst's role. The good old catchall of "other tasks as defined from time to time" makes up a significant portion of the daily tasks heaped upon the Business Analyst.

At one end of the scale companies use the experience, knowledge and expertise of their Business Analysts to help shape their strategy. Multi-million pound IT projects or remodelling the corporate structure become reliant on the involvement of the Business Analyst. And at the other end, the Business Analyst is documenting a process for how the Contact Centre's IVR flow works or how the paper clips get ordered.

As is the case for most roles, the ability, knowledge and competence of those in the Business Analyst skills pool can vary hugely. Though if the role of the Business Analyst isn’t properly understood or appreciated resource allocation can often take its cue from selecting the sports team at school. The popular kids being picked first and the weedy kid with the strange odour being left as Hobson’s choice. This can result in the top talent being reduced to counting the paperclips and the task oriented Business Analysts being left to do root cause analysis on why the organisation’s strategy is failing. When it comes to how organisations value their Business Analysts, all too often their all round ability and general willingness to pick up the threads that everyone else is all too willing to leave hanging seems to count against them. They can be left feeling either undervalued or overstretched because their skills aren’t being used appropriately.

Whilst clear definition exists between Programme Managers, Project Managers and Project Management Office roles or Enterprise, Project and Software Architects, for the Business Analyst the differentiation is often made through the subtlety of a prefix such as Principal, Lead, Senior or Junior. This lack of clear definition shouldn't undermine the value placed on a core component of the project team. Organisations who use find and replace to differentiate their Business Analyst job descriptions, giving the same tasks a different verb to show the level of the person, need to think differently.

As we look to do more for less, harnessing the benefits of fleet of foot, agile delivery in both business process design and technology delivery, Business Analysts will segment further into those who have the skills of strategic, enterprise thinking; and those who are task focussed with a keen eye for detail. And as organisational structures becoming slimmer and more streamlined, often with business functions outsourced en mass, the need to empower Business Analysts to represent a smaller group of stakeholders in making decisions based on their own breadth and depth of knowledge will grow. The Business Analyst, with the ability to define the strategy and with the business or subject knowledge to make decisions, will be required to fill the gaps in this slimmer structure. Meanwhile the task oriented Business Analyst will support their peers in bringing their vision to fruition.

Whether the Business Analyst role will morph into Enterprise Analysts, Project Analysts and Process Analysts or whether organisations will begin to recognise the subtlety of the prefixes currently in existence remains to be seen. For those working as a Business Analyst to have better definition of their role and the opportunity to be allocated to work based on their skills is undoubtedly attractive and will drive the marketplace; with the value and desirability of the roles at the Enterprise level becoming rightly more marked.

Organisations who fail to remove the ambiguity from their job descriptions will be the ones who are left with only the task focussed Business Analysts; whilst those who make the definition and reward appropriately will reap the benefits at both ends of the scale.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identityYou don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Unblocking Digital Identity

noreply@blogger.com (Bryn Robinson-Morgan) — Sun, 02 Aug 2015 12:11:00 +0000

When it comes thinking about citizen identity schemes, centralisation is so Y2K. A decentralised or federated model would remove the bureaucracy, put the customer at the heart, delegate control to the user and balance security and usability. Though look out federation, there is a new kid in town. Distributed is where identity is at - or is it?

Blockchain, the distributed ledger solution behind Bitcoin, is becoming the hot topic of the digital identity world. It ticks many of the important boxes - privacy by design, cryptographically secure, robust architecture, irrefutable provenance, consent and control with the user. So Identity on the Blockchain could be the next big thing for citizen eID.

Though before giving up on federation we should put Bitcoin in context. Relative to the British Pound (born 775), Bitcoin is a mere pup (born 2008/9) - though to compare it with another digital disrupter, by the time Facebook was 6 years old it had over 600m users - Bitcoin has less than 4m. Having an unregulated, community owned technology is arguably more of a negative than a positive - particularly when it comes to things of value. It is estimated that around a third of the Bitcoins created are now classed as zombie coins - the cryptographic keys required to transact them lost at the bottom of a rubbish tip. And with no central authority there is no redress, no one to hold accountable other than the end user themselves.

Though the lack of a central authority has created a marketplace for a federation of exchanges and wallets; performing as an intermediary between the end user and the overall community. Though in an unregulated marketplace how can you trust these intermediaries? With loss of their customer's crypto keys and pending criminal prosecutions it would seem the answer to that question is that you can't.

While the Blockchain may be a future technology upon which citizen identity could be based it is also worth considering that the concept of the distributed ledger for identity has been used successfully for quite some time. In the UK the General Register Office has been operating the exact model since the late 18th century - with births, deaths and marriages being recorded in local registers, that issue certificates to the end user, that they control as the central authority.

Bitcoin and Blockchain are technology led solutions that have gained a niche use in financial payments. The same technology will have a role to play in pure play identity and access management solutions and it may solve use cases within the citizen eID space - though doing this from a customer led perspective to find the technology solution will have a greater chance of success.

The core challenge for a successful citizen identity scheme is to hit the sweet spot between allowing the real person to claim and assert their identity and preventing anyone else from doing the same. Balancing how easy you can make the former and how difficult you can make the latter comes above whether your solution is centralised, federated or distributed.

So maybe centralisation isn't quite so Y2K after all. Maybe federation will solve the issues. Maybe the future is Blockchain or another distributed ledger model. Though if you were looking for the best solution - maybe, just maybe, a model based on the best of all of them could be the real future?

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Unexpected Customer Behaviour In The Bagging Area

noreply@blogger.com (Bryn Robinson-Morgan) — Tue, 05 May 2015 10:21:00 +0000

This week saw the UK's forth largest supermarket, Morrisons, announce the return of staffed express checkouts. As the first major retailer to make the u-turn, what now is the future strategy for self-service? Are Morrisons responding to a change in customer shopping behaviour or did they, along with the rest of the retail market, get their strategy wrong in the first place?

The figures show that only one in three supermarket customers had used self-service; what makes this figure even bleaker is that queues at staffed checkouts have actually lengthened where self-service has been introduced. For supermarkets, self-service checkouts have played a contributory factor in the loss of customers to smaller rivals who are seen to offer a better experience with personalised service at a lower cost.

Lowering staff headcount to reduce operating costs is the headline benefit for most organisations who have introduced self-service checkouts. Unfortunately when cost reduction is at the heart of your customer service strategy the outcome is fairly predictable. Customer behaviour shouldn't have been unexpected - the impact on satisfaction levels when you introduce cost saving measures are, with the odd exception, going to be negative.

It is unlikely though, that self-service will be removed from the customer service strategy of any retailer. And nor should it be. As someone who has implemented self-service into the retail sector, I believe that it has an even greater role to play in retail strategy in the future. Yet those organisations who implement it correctly will be the ones whose focus in on improving the customer experience through the use of technology. A by-product of this will be the cost saving through headcount reduction.

One of the best examples of self-service is travel ticketing used on the London public transport network. In order to migrate customers to self-service they introduced the Oyster travel card. Within ten years of its introduction in 2003, Oyster was used in over 80% of all journeys. So successful that self-service ticketing will allow London Underground to close all of its ticket offices by the end of 2015 - down from over 250 when Oyster was first introduced. These are figures that supermarkets can only dream of.

The reason why self-service for London public transport has been so successful is that they used the introduction of Oyster to make self-service ticketing more convenient for their customers. The strategy for implementation was built upon a simplified pricing policy, highly reliable infrastructure and incremental migration of more complex products as customer advocacy grew.

For retailers, this lesson of simplifying the underlying customer experience, making self-service the convenient choice, ensuring the platform is reliable and only growing as reliability is proven and adoption grows, is one they can still use. Simple measures that can overcome the failings of current technology or operating constraints need to be considered. The complexity of the transaction needs to be reduced - if you need to train your staff to do a task don't expect your customers to be able to do the same task without training.

For customers, the use of self-service check outs needs to be a preference – a choice that they make rather than something that is enforced on them by the retailer. This preference may be subject to the context – a basket of shopping can drive significantly different behaviour than an over-flowing trolley of goods. Putting the customer at the heart of the retailers self-service strategy will enable context to be considered, behaviours to be modelled and solutions to be designed to meet customer needs. In an increasingly digitally enabled world, self-service will also be omni-channel; a richer experience in store and online that delivers convenience and benefit to customers that encourages the adoption of self-service and a migration away from staffed checkouts.

So whilst Morrisons may have seemingly made a u-turn, in reality they should just be revisiting their customer service strategy to make sure that when it comes to self-service, customer behaviour is not an unexpected item.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Tick to Agree

noreply@blogger.com (Bryn Robinson-Morgan) — Tue, 07 Apr 2015 08:04:00 +0000

Do our customers really trust that we do the right things for the right reasons when it comes to their data? The digital economy is founded upon data that belongs to our customers. We may source it, store it, aggregate it, make sense of it, commercialise it... yet if we share it just how informed should the consent be from the people who own it?

We've witnessed tiny tremors that have been described in the media as a backlash; though in the scheme of things the customer reaction was nothing more than tomorrow's chip paper. Sony may have lost a heap of credit card numbers but its customers were soon distracted by a free game to download; Google may be evil but their customers don't have time to search for a new search engine; Facebook may have the right to replace you with a substitute human should your own life become too dull but their customers want to know when their friends are drunk. (There may be some artistic licence at work here I admit :)

The fact is that to date nothing has occurred that has truly caused a customer backlash in the way in which we organisations trade their data. Even the most outraged, moralistic, educated and knowledgeable customer still ticks the terms and conditions box without instructing a lawyer. They still swipe their loyalty card at the checkout to buy the newspaper with the headlines about the latest data privacy breach. And they still send emails and check the adverts specially tailored for them that magically appear.

We wouldn't give our customer's money away quite so nonchalantly; so is doing the right thing with their data treating it in the same manner? Rather than getting our customers wrapped up in 56 pages of terms and conditions written by the legal department on how we intend to use their data it would seem much fairer that our marketing department wrote our key terms. The same points on how we source it, store it, aggregate it, make sense of it, commercialise it - written in easy to understand bullets.

If we start being transparent with our customers about our role in the use of their data we may have to rethink our data strategy. How we commercialise their data; what, how and when we share may have to be done in more innovative and customer centric ways.

The alternative is that we continue to ride on the wave of customer apathy. We can continue to tell customers that we might do bad things, on purpose or by accident, with their data but never mind because you agreed we could.

Over the next 5-10 years the tide is turning and the wave of apathy will come crashing down. Simply with the amount of data we will hold and the value it contains, the organisation who doesn't treat their customer's data like their customer's money will be the one to drown.

Now is the time to start building our customer's trust by doing the right things for the right reasons when it comes to their data.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis

Unexpected Customer Behaviour - The role of self-service in your customer service strategy

Rip it up and start again - The successful Business Transformation

Too Big To Fail - Keeping the heart of your business alive

The upstarts at the startups - How startups are changing big business

One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me

Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

The Kids Are All Right

noreply@blogger.com (Bryn Robinson-Morgan) — Sat, 21 Feb 2015 01:25:00 +0000

Age 19, when you're throwing up on your own shoes, privacy, security and liability don't matter; what the "going grey" generation call convenience, does. If you can get a taxi cab to deliver you safely to your door, you will happily give full access to your identity (the location of your comfy bed with a tactically placed bin at the side of it) and financial information (promise not to take the long way round).

This week, in the UK, the first integration of Apple's Touch ID came to banking applications. Cue uproar on how the technology has already been spoofed. Any security person worth their salt knows fingerprint biometrics aren't secure. Yes they may be more convenient than pass codes, but a high resolution camera or a shiny surface combined with a silica moulding kit and you have a security breach quite literally on your hands (well fingers).

The trouble is, that by the time you're old enough (in the "going grey" generation) to know the pitfalls, and you're suitably well established in your industry to be able to inform standards and best practice, you're no longer representative of the "yoof" generation who you're delivering products for. Nothing kills a great idea for the younger generation than their grandparents thinking it's cool. When your Gran sends you a snap of her running over someone in her mobility scooter, it's time to delete your account and move on to the next craze.

So are the people setting the standards and defining best practice really focussed on the right things? Are they really best placed to do so? For a banking application, is Touch ID too much security rather than not enough? Organisations want to know that the person making the transaction is authorised to do so, to enable them to prevent fraud, meet regulatory requirements, protect their customers and generally do the right thing. Yet from the customers perspective all they're concerned about is that if money goes from their account that they didn't authorise that they'll get it paid back.

Ultimately the role of the "going grey" generation is to warn, counsel and support the next generation. Informed choice rather than condescending control, and guided resolution rather than an "I told you so" attitude. Understanding the needs, views and opinions of "the kids" will drive better solutions focussed on outcomes of practical use. The younger generation don't value convenience; they expect it as a minimum! Whilst sometimes this may result in loss or distress for either party, consequences are thought about after the event and there is a customer perception (rightly or wrongly) that someone else will help clean up any fall out.

A new view on authentication is that it is something that occurs as part of the transaction rather than something the user knowingly does. Mitigating risk at other points before, during and after the transaction, will enable less reliance on strong authentication methods. Does the transaction fit within the normal patterns of behaviour? Is it being performed from a trusted device? Is the location identifiable and known? Is the value within acceptable risk tolerances? Can the transaction be reversed? And for what time period is it recoverable?

Within all this, the concept of informed choice by the end customer also needs to be considered. Rather than industry experts having an outcry of nay saying about technologies such as Touch ID being used for banking, rather they should be focussed on the needs of the customer and giving them more credit for being able to make informed choices. If any fraudulent transaction could be recovered then zero authentication transactions would be less risky.

Figuring out how, when at 3am your customer's account has been debited £50 that they can't recall authorising, you can resolve the dispute is a far more noble cause than worrying about the authentication method used to verify the transaction - particularly if your customer arrived home safely and able to sleep in their own bed, with their head rested on their bin.

After all, the kids are all right.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour - The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture. Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan