The consortium for open federated identity and web services standards said its Strong Authentication Expert Group has been created to speed the worldwide deployment of interoperable strong authentication and to help organizations meet new industry-wide demands for universal strong authentication solutions.
The Strong Authentication Expert Group (SAEG) consolidates the work Liberty Alliance has been doing for the past year in defining market requirements for deploying strong authentication in federated networks. The group aims to expand this work beyond federation to build ID-SAFE (Identity Strong Authentication Framework), an open framework to allow strong authentication systems such as, hardware and software tokens, smart cards, SMS-based systems and biometrics to interoperate across organizations, networks and vertical market segments.
"With increasing industry demand for better protection against online fraud and identity theft, there can be no question that the time for universal strong authentication has come," said Timo Skytta, vice president of the Liberty Alliance.
"By forming the Strong Authentication Expert Group, Liberty is committing to rapidly deliver well defined and highly deployable solutions to help organizations meet new and pressing requirements for stronger authentication."
The Liberty Alliance move comes after the Oct. 12, 2005, decision by the US Federal Financial Institutions Examination Council (FFIEC) to issue new guidelines for banks on online authentication. These new standards acknowledge that passwords alone are insufficient as the only means of security to protect consumer bank accounts and call on banks to implement better ways to authenticate the identity of customers using online products and services. While governments and organizations around the world have moved to implement similar requirements, financial institutions based in the US are expected to achieve compliance with the new FFIEC guidance by the end of 2006.
"Gartner predicts that by 2007, 80 percent of organizations will reach the 'password breaking point' and will need to strengthen user authentication with alternative security methods," said Ant Allan, research vice president at Gartner.
"Businesses need to put roadmaps in place now that will allow them to phase out passwords and replace them with stronger authentication methods."
Strong authentication requires at least two forms of identity authentication for accessing a network or online application. Liberty's ID-SAFE standard aims to offer standards-based online identity protection to allow organizations to deploy interoperable strong authentication faster, more cost-effectively and on a wider scale. The consortium is modeling the ID-SAFE technical development process on the successes Liberty has had in rapidly driving open identity specifications for federated identity management (Liberty Federation Framework, ID-FF) and web services (Liberty Web Services Framework, ID-WSF).
"The lack of strong authentication in the online space is demonstrably one of the most significant causes of identity theft," said Michael Barrett, co-chair of the Liberty Alliance Identity Theft Prevention Group, and vice president for Security/Utility Strategy at American Express.
"The recent FFIEC guidance on strong authentication will likely change how organizations manage online identity threats, but initiatives for addressing these issues need to be coordinated via agreed industry standards - and that's where the Liberty Alliance has a strong track record of fast delivery," he said.