The Internet is now well established as the world's most universal IT resource - an indispensable business tool, and an increasingly important domestic one too.
Consumers, for instance, like the convenience of being able to pay bills and access banking accounts from home, and of course the opportunity to browse an ever growing, international virtual shopping mall.
Merchants in turn appreciate its low-cost, high-yield global market reach, whilst corporates have been quick to harness it for faster, cheaper, yet more effective communications with staff, customers, suppliers, banks, and other business associates.
Nevertheless, potentially at any rate, the Internet presents as much strategic risk to businesses as it does strategic merit. As an open public network, it can offer users no guarantee of information security, privacy or integrity, and the growing number of data thefts and virus attacks on big-name company systems around the world show just how easily these can be violated.
It's a major cause for concern. After all, there's very little business benefit in being able to transfer strategic data anywhere in the world in seconds and at the cost of a local phone call if that information can be just as quickly and easily intercepted, used and abused - and more especially if the violation can't even be detected.
Ultimately, it all boils down to a question of trust. Can we really trust in the Internet as a safe place to do business when it is by nature so open and anonymous? Is it a business friend, or will it prove to be foe?
Consider for instance how in the real world we build trust through several well established, internationally recognised business practices used to minimise risk and hold people accountable for their business activity. These are usually based on the ability to substantiate identity; ie, we make sure we know exactly who we are doing business with and that each party to a transaction clearly understands the nature of that transaction before it is concluded.
We may, for example, draw up a business contract which defines the nature and extent of the transaction and the responsibilities and liabilities of each party, and these are signed and witnessed to make them legally binding upon each party in the event of a dispute.
But this process has been less easily managed in the virtual world where online communications means little or no physical contact between parties and no tangible proof of identity or indeed integrity of intent. Being able to trust in the business process in such an anonymous environment is difficult - and understandably so.
Unfortunately, security systems so far have been more focussed on keeping hackers out of corporate networks, and few electronic business systems yet comply with the minimum level of established business practices that we have built up in the real world.
Specifically, few have replicated a facility for a signature that can be accurately and reliably traced to the person committing the transaction. But the more companies start moving real business processes into electronic form, the greater the need to be able to do so to prove accountability and identity as well.
That's why digital certification, and more recently Public Key Infrastructure (PKI), have attracted such keen interest from major stakeholders and Internet security specialists globally. Together, these technologies promise to deliver the final solutions needed to establish real trust in the Internet and move it ahead as a true and stable vehicle of international commerce.
This is how: PKI uses a combination of digital certificates, strong encryption and secure session protocols to uphold the six basic pillars of information security on the Internet: identification, authentication, authorisation, integrity, confidentiality and accountability (or benefit of non-repudiation).
Whilst encryption and protocol technologies address mainly privacy and confidentiality issues, digital certificates (or Digital IDs), tackle the more thorny issues of identification, authentication and accountability.
Issued by a reliable third party Certification Authority like SACA, the certificates bind evidence of each user's identity to a unique set of mathematically derived and encrypted public keys which cannot be forged, hacked or stolen. Thus they act as a virtual passport or identity document in cyberspace whilst the issuing CA stands in as a virtual 'witness' backing up the integrity of the certificate holders (that they are who they say they are), and of the communications between them.
This leads on to the crucial element of accountability, which is further strengthened through the incorporation of digital signatures contained within the digital certificates.
Like the certificates themselves, digital signatures used within a PKI environment cannot be forged, and once an electronic document is digitally signed, it cannot be altered even at the point at which it is processed. This reduces the possibility of internal fraud and ensures all parties to the contract can be held to their agreements.
What it also means is that, within the PKI management environment, a full audit trail of online communications activity can be maintained, stored and referred back to, where identity can be reliably authenticated via the digital certificates in the first instance and accountability upheld via the digital signatures.
Since both are tamper proof, integrity of data and of the business process itself is intact.
It is possibly worth noting at this point too, that US lawmakers have recently conferred digital signatures with the same legal weight as their on-paper counterparts - a move likely to be quickly adopted elsewhere in the world and which is sure to give a further spur to global e-commerce initiatives.
Whilst the definition of 'electronic signature' contained in the new law is deliberately broad, it is generally acknowledged that PKI technologies have set an early high and extremely viable standard, from both a cost and ease-of-use perspective.
It's not surprising then that we are seeing rising demand for Digital Certification solutions in South Africa in line with, and in some cases leading, international trends. The technology establishes a level of trust which allows for common practices of commerce, control of rights and contractual agreements to take place and be protected within the faceless realm of the Internet.
Ongoing growth in the popularity of corporate VPNs (Virtual Private Networks) is also obviously fanning much of the interest.
VPNs are secured networks on a company Intranet that use Internet technology and protocols to link up users within the corporation, as well as with clients, suppliers, and other designated business associates outside of it.
Data communications and transactions are typically secured through a combination of firewalls, strong encryption and secure session protocols (either SSL or SET), but digital certificates are becoming crucial to the process of authentication. Their incorporation is helping businesses really exploit the strategic advantages the Internet offers for improving communication, cutting costs, enhancing services and leveraging competitive advantage, without ever putting their intellectual assets at risk.
Not that companies need to have a VPN in place to benefit from digital certification. In fact, many banks and credit companies are now encouraging individual clients to invest in digital IDs to tighten security on electronic transactions and protect confidential personal data and credit card and other account information.
Indeed, anyone wanting to transfer confidential information or conduct critical business over the Internet should seriously consider registering a Digital ID. In such a faceless, intangible business environment, there needs to be a reliable method of determining identity in order to achieve the level of trust necessary to engage in online transactions.
Encryption technologies are simply not enough. However effectively they might scramble data so that it cannot be read as it passes over the Internet, this is no real solution if the person at either end of the message is not who they claim to be.
Accountability, non-repudiation and legal recourse are issues that cannot be solved by standard security solutions alone. And this being the case, responsible companies need to realise that digital authentication solutions are no longer a nice-to-have option; they are an absolute essential in the drive to make the Internet a safe, trustworthy place to do business by providing irrefutable evidence of identity in cyberspace.
Share
