We are in the midst of a cybersecurity boom, as cyber criminals are increasingly exploiting digital vulnerabilities. These attacks include those aimed at our identity and personal data. Which are the most common ones? What can we do to protect ourselves?
Protecting your digital identity is a need that is increasingly being taken into consideration by society. In fact, according to the latest Unisys Security Index, 69% of the population is more concerned about identity theft rather than a physical incident, national security issues, or a natural disaster.
In order to know how to protect our digital identity, we must first know exactly what this is, how to use it and what are the current threats in terms of attacks. Finally, we will share some advice on how to use it in a safer way.
Definition of digital identity
Broadly speaking, we can say that digital identity is the result of transferring the physical identity of a person or entity to the technological universe. To be more specific, we can consult the description of this concept made by some entities.
For example, the International Organization for Standardization (ISO), defines digital identity as:
“An item inside or outside an information and communication technology system, such as a person, an organization, a device, a subsystem, or a group of such items that has a recognizably distinct existence.’’
The World Economic Forum defines also defines digital identity as:
“A collection of individual attributes that describe an entity and determine the transactions in which that entity can participate.”
However, it is important to make it clear that digital identity and digital reputation are not the same concept, because the latter refers to the opinion that an individual or organization has on the Internet, which usually comes from our comments, publications and, in general, all the online actions that we make public.
How to manage digital identity?
Within the features that conform digital identity we find personal data. Nonetheless, not all personal data can be considered a feature of digital identity.
An example of this could be the geographical location of residence, which is common to thousands or even millions of people. Only if it is combined with other more precise and exclusive information could we consider it as valid.
To manage digital identity, we have two approaches, although the current trend is a combination of both.
On the one hand, we have management based on digital signatures, certificates and cryptographic devices, all static. On the other hand, there is dynamic management, which uses different data sources for identification.
This combination of management models eventually crystallizes into a system based on the following elements:
- Something the person know, such as a password
- Something the person has, such as an identification card
- Something the person makes or is, such as biometric data
Most common identity attacks
Among the most common identity attacks phishing appears to be rising, which are impersonation attacks. This is reflected in Microsoft’s 2019 Security Intelligence Report, which states that 0.7% of the emails analyzed included phishing, compared to 0.49% the previous year.
On the other hand we have ransomware, which reached 0.02% in 2019, while in 2018 it was 0.11%. These events have a greater incidence in emerging countries in Latin America, Africa and Asia, while in more developed economies the number of cases is almost negligible.
These cyber-security problems are often caused not only by the bad faith of the criminals, but also due to the lack of action against them, mainly lack of knowledge. The State of the Phish report by Proofpoint brings interesting conclusions in this regard:
- 45% reuse passwords
- More than 50% do not secure their home networks with a password
- 90% use work devices for personal activities
- 32% are not familiar with virtual private network (VPN) services.
- Many users do not recognize common cybersecurity terms such as phishing, ransomware, smishing or vishing.
Ways to protect digital identity
Now that we know what digital identity is, how it is managed and why we need to protect it, we will provide you with some guidelines for its protection. These are complementary to the ones described in our article 5 ways to protect your digital identity.
Increase the security of DNS servers
The Domain Name System, popularly known as DNS, is responsible for translating a domain from a web address to the IP address where it’s located.
That is, a DNS server contains sensitive information on addresses and names. That is why it is advisable to have few DNS services, preferably 2 (one for service and one for backup). This way you have greater control over them.
DNSSEC (System Security Extensions) is currently being implemented in many DNS services. This makes it very difficult to modify the data that is located on these servers.
Use tokens
Verifying your identity by using tokens is a measure that has become quite popular. For example, when we purchase online using our credit card, it is common for a purchase code to be sent to our mobile phone or email so we are able to verify the transaction.
At Viafirma we use tokens in our solutions. Examples are when we authenticate using a digital certificate in our centralized signature tool
Two factor authentication
One of the key steps for a robust authentication is adding a second layer of security. This is based on setting a two-factor authentication for accessing a digital service.
These authentication factors must be selected from the three types of factors listed in the section on digital identity management. Among them we can include the aforementioned tokens, which would fit into the classification as something the user has.
Protect your Bluetooth connexions
Bluetooth devices that are commonly used, such as wireless headsets, can be a gateway for hackers who have malicious intentions.
To avoid attacks through this wireless connection, we recommend using LTK encryption, avoiding connecting to unknown devices, keeping ours invisible, checking the list of trusted devices as well as not sharing any additional information from our device.
Digital identity clearly needs to be carefully supervised and watched over in a world that is increasingly turning to online services. These are basic principles of protection that are applicable to all areas of society, especially those containing more sensitive information.
These include those areas related to healthcare services. The so-called eHealth is becoming more and more popular in the health sector. It includes aspects such as electronic medical records and electronic signatures for informed consent to be able to carry out certain treatments. For more information, we recommend you to read:
At Viafirma our solutions include measures to strengthen the security of digital identity, while complying with the legal frameworks in force, as well as our commitment to offer user-friendly and efficient services. If you believe that we can help you carry out your online operations more safely, please do not hesitate to contact us.