ISC West: Your Mobile Device as Your Identity

Connected Security Expo Launches as an adjunct to ISC West 2016

Multiple Companies Feature Virtual Badges (Your Mobile Device as Your Identity)

ISC West 2016 opened with an additional feature reflecting how today’s leading security platforms are now serving both logical and physical access requirements.  In fact, the Connected Security Expo’s main theme is “Bringing Logical and Physical Security Together.”  

Large companies in the space such as Dell, BAE Systems, MicroStrategy, and GE all had a presence. A special Innovation Stage enabled vendors to present next generation products and technology and how they were making the connection to deliver holistic, security-enhancing, risk reducing and more affordable and user friendly approaches.  

A keynote speech given by Mathew Rosenquist, Cyber Security Strategist at Intel, was “The Future of Cyber Security” covering how connecting logical and physical security is affected by cause-and-effect relationships and highlighting “insights and perspectives of the forthcoming challenges the industry is likely to face and how we can be better prepared for it.”

Interestingly, Mike Howard, the CSO of Microsoft, illustrated how important it is to establish proper governance and how the “CSO and CISO are two sides of the same coin, they share a similar journey, manage similar challenges and both need to focus on the development and growth of their teams.” His presentation was entitled “CISO & CSO Relationship: What it is, What it Should be,” and in it he brought out how important it for the CSO and CISO to develop a partnership, develop security policies together, and encourage cross-team discourse and workshops to ensure each team learns about one another.

Multiple exhibitors at ISC West and Connected Security Expo were presenting solutions that take advantage of these and other advancements in mobile technologies to connect logical and physical security via virtual badges (cryptographically-protected data objects that represent your identity claim).

Connected Security Expo, ISC West: Your Mobile Device as Your Identity

Figure 1- Usher by MicroStrategy implements virtual badges on mobile devices to connect logical and physical security and serve as a security platform for other identity-centric applications.

First up, Usher by MicroStrategy.  Recently awarded Best Multifactor Solution by SC Magazine, Usher is a full-featured connected security platform for the enterprise that includes virtual identity badges built on PKI technology, biometric authentication and rotating numeric and QR code support on device, integrated logical and physical access, soft physical access keys, peer-to-peer authentication (in-person and remote), telemetry and geofencing using both Bluetooth (BLE) beacons and GPS coordinates, integrated messaging using SMS, push notifications or FaceTime, and built-in identity and security analytics.

Usher supports Mac OS / Windows logon and pre-integrates with all the leading PACS vendors (like Tyco). Usher also supports dozens of VPNs (like Cisco) and cloud and mobile applications (like Office365), as well as pre-integration with multiple authoritative directories (like Active Directory).  With all of these features, it was clear to me why they have been winning over multiple Fortune 1000 customers.

Connected Security Expo, ISC West: Your Mobile Device as Your Identity

Figure 2- HID Mobile Access incorporates virtual badges that require you to simply twist your wrist near an HID iCLASS SE reeader to gain access.

Another vendor leading in the mobile identity space is HID Global. HID Mobile Access, a 2015 SIA New Product Showcase winner, leverages their Seos protocol and is focused mainly on Bluetooth (BLE) communications between Android and Apple devices and their iCLASS SE door readers.

A cloud service called Secure HID Identity Services provides a centralized solution for creating and provisioning the virtual badges to the right mobile devices (usually smartphones).

HID Mobile Access has been enjoying significant uptake in the last year or so (including by companies like Netflix) selling entirely through partners in their official distribution channel.

Connected Security Expo, ISC West: Your Mobile Device as Your Identity

Figure 3- Allegion showcased their NFC-based product aptiQmobile.

Allegion is another key mobile identity and credentialing provider with their aptiQmobile product focused on NFC technology in Android devices.  Allegion virtual badges are provisioned by approved solution partners that create the virtual badge, email to the user the notification to download the virtual badge, and then the user downloads the virtual badge and authenticates with a PIN before using the badge.

Allegion uses a 128-bit encryption key that is decrypted by the door terminal, a screenlock feature that keeps the virtual badges safe, and a patent-pending anti-playback technology so that transaction cloning is not possible. As a double bonus, all virtual badge credentials are stored in the same memory of the mobile device as app passwords with sensitive information.

As we continue to witness the amazing proliferation of mobile devices and their impact to business processes, it is becoming clearer that their various built-in technology support such as Bluetooth (BLE), NFC and biometrics are turning these devices into platforms for logical and physical security including for the enterprise, as well as B2B and B2C applications.  We look forward to more and more personalized experiences, less friction in transactions and higher security with lower cost with our virtual badge dynamically linking to new privileges and use cases over time.