Industry executives and experts share their predictions for 2024. Read them in this 16th annual VMblog.com series exclusive.
3 Experts on Future of Digital Identity, Regulation and AI
By Mark Ruchie, Vice President, Information Security Advisor, Entrust
Just this last year, NIST instituted their latest regulations for post-quantum cryptography standards, the Biden administration signed the first-ever AI executive order, and calls have been made to eliminate passwords nationwide. As a result, the cybersecurity industry strategies had to evolve quickly. Leaders are still learning more about AI’s potential, adjusting to new regulations and guidelines, and continuing digital transformations across industries like retail and banking.
At Entrust, a global leader in trusted payments, identities, and data, we spoke with our leaders across departments to learn more about the trends security teams should expect going into 2024:
Jordan Avnaim, CISO:
CISOs need to prepare for regulatory surge in 2024
“The Biden Administration’s recent Executive Order, the first of its kind in the U.S., to establish new standards for AI safety and security, and the SEC’s latest guidelines on cybersecurity risk management represented an importantmilestones for security in the evolving threat landscape. In the next year, we expect a regulatory surge that CISOs must prepare for – which could include continued AI regulation, new post-quantum guidance, and, in late 2024, new legislation is expected around Know Your Customer (KYC) guidelines. Businesses should consider each of these a call to action to improve not only their own cybersecurity strategies, but also to consider the impact of new technologies, like AI, on their organization and their customers.
An uptick in government guidance will help create a blueprint for businesses to navigate rising challenges and security threats. But understanding and complying with the anticipated patchwork of regulations and regional legislation may pose a challenge for businesses, especially those operating across borders. In the U.S. alone, at least five more state privacy laws will go into effect in 2024, including those in Washington, Oregon, Texas, Florida, and Montana. CISOs and leaders will need trusted advisors, sound support, and secure solutions to successfully and safely forge ahead.”
+++
Greg Wetmore, VP of Software Development:
It’s the year of reckoning for the identity crisis: The decentralized identity movement goes mainstream in the age of AI
“With the rapid development and adoption of AI, we have seen bad actors find new ways to exploit the technology and use it to create more sophisticated phishing attacks and deepfakes at scale. Generative AI can craft highly convincing phishing messages that mimic the writing style of a trusted contact, making it increasingly difficult to spot these malicious communications. Their top targets? Consumer identities.
Identity is the thread that ties the world together, making it a high-value target for cybercriminals. This will reach a fever pitch in 2024 as the entire nature of identity is being disrupted as a result of AI making it increasingly difficult to know who to trust and how to identify who (or what) you’re interacting with. To overcome these challenges head on, we predict more organizations will adopt a decentralized approach to identity and turn to increased levels of verification, including knowledge-based, document, biometric and device authentication to further validate users.
The bottom line: It’s time to give individuals full ownership of their identities. With decentralized identity, all the information used to build an identity is encrypted and protected with digital keys that can be used to confirm an individual’s identity without exposure. Businesses don’t store those – the individual does. The core elements of a decentralized identity framework include an identity wallet, blockchain ledger, decentralized identifier and zero-knowledge proofs. Decentralized identity is overdue to go mainstream, and in 2024, we must all work towards a world with more privacy and less fraud. There is no reason why consumers should continue compromising on privacy, trading their identity for access, and taking the security risk that comes with surrendering their personal information in order to get the products, services or information they want.”
+++
Jenn Markey, VP Product Marketing, Payments & Identity
Inclusion and access in digital identity become table stakes
“As the lines between our physical and digital lives continue to blur, our world is increasingly moving towards a future where digital identity is foundational to social and economic mobility – which presents significant regulatory, ethical and practical implementation questions. Many of us take for granted having an ID – without realizing what it means not to. According to the World Bank, 850M people globally do not have a physical identity – many of whom are members of marginalized groups and the majority are children whose births have not been registered. Having proof of identity is a basic human right. Without it, you are denied access to the fundamentals of life – you cannot register for school, get a job, open a bank account, buy a house, or receive social assistance payments.
As we continue to increase access to digital services, there is an even greater need for secure and convenient identity verification, online or in-person. In the next year, we will see these changes drive an urgent call to action as identity technology becomes more integrated in our everyday lives. This could mean improving access to mobile smartphones, ensuring apps use basic language instead of technical, offering setup assistance at major travel points, etc. In 2024, progress must be made to make digital identity truly inclusive and accessible to all.”
Across industries, for as many benefits AI can bring to an organization, leaders must also be aware of its cyber risks and incorporate mitigation solutions into their 2024 plans including against threats like accuracy, threat creation (social engineering, code-based, etc.), privacy and confidentiality concerns.
As AI continues to expand (and transform the world as we know it), all organizations, no matter the industry, must embrace the use of the technology and be ready to pivot and change plans throughout the coming year, as needed. The biggest advice I can offer my peers is to never get complacent because cybersecurity is never done. The AI-driven threat landscape is constantly evolving, so our security plans and strategies must as well – which means we must remain nimble and focused on the next potential threat.
##
ABOUT THE AUTHOR
Mark Ruchie, CISSP is the VP Infosec Advisor at Entrust. Mark joined Entrust in January 2015 and has worked in the security field over 30 years with security leadership positions at UnitedHealth Group, the US Air Force and KPMG and holds a Masters in National Security Studies from Georgetown University.
