The urgency behind solving the cyber identity problem

White House Cyber Coordinator Howard Schmidt used a keynote speech at a well-attended conference in Washington yesterday to make the case for improving how people and systems are identified in cyberspace—an indication of how important the Obama administration considers identity management to overall cybersecurity efforts.

While a focus on better verifying the identities of feds that use government computer systems isn’t new—after all, that was a key aim of the Bush administration’s Homeland Security Presidential Directive-12 smart card initiative—Schmidt wants to improve online identification outside of government as well.

Schmidt framed the problem of accurately identifying people and systems in cyberspace as one that affects security and economics. The ability to conduct cyber transactions involves everything from electronic medical health records to online banking, and he called for the creation of an identity ecosystem.

“Not only do we have to worry about who we are interacting with, but those on the other side [that] we’re doing business with—whether it’s business with government, business with banking, business with transportation—that those computer systems have to trust that it’s really us, and with the botnets we’ve seen, the comprised computer systems, that’s been as much of a challenge as anything else,” Schmidt told a crowd at the Symantec Government Symposium in Washington.

Schmidt previewed a draft national strategy for improving the trustworthiness of digital identities in cyberspace that the White House plans to release June 25. He said improving how people are identified in cyberspace shouldn’t make things harder on end users; rather, solutions should be cost-effective, easy to use, and voluntary.

“We should not have to dramatically change the way we do business,” he added.

According to Schmidt, the use of the public key infrastructure will enable enhancements. He said that the roughly 17 or so passwords that he has aren’t getting any easier to remember.

“The end user shouldn’t have to sit there and figure out [whether] this is something that has the ability to have somebody infringe upon my privacy. Is this something that I could lose my credit card number over, they shouldn’t have to think about that so as a consequence we’re looking to make it more convenient?” he said.

In the end, the extent that the White House’s strategy, the National Strategy for Trusted Identities in Cyberspace, leads to developments that make things simpler for the vast majority of Internet users who aren’t technologists will likely play a big role in whether Schmidt’s vision for an online identity ecosystem is realized.

“We all know in this room the more complex security is the less people that are going to use it, so if we make security part of things they’re used to doing anyway, they’ll use it,” Schmidt explained.