As we enter a world dominated by nation-state actors and AI deepfakes, high-risk organizations require a robust identity perimeter that synthetic identities cannot breach. OTPs and SMS-based authentication cannot provide this level of protection – unlike IAL3 verification which uses superior strength evidence linked to biometric matches during supervised sessions.
This once in-person process can now be conducted remotely using chat, video, facial recognition with liveness detection and document authentication – creating a scalable and repeatable IAL3 proofing process that lowers cyber liability insurance premiums as well as operational expenses associated with password resets.
IAL3 Compliant Solution
NIST IAL3 verification represents the highest level of identity assurance in the NIST digital identity guidelines. This process includes in-person proofing, submission of superior strength evidence and binding an authenticator to prevent stand-in fraud. Furthermore, it limits highly scalable attacks such as evidence falsification while giving CSPs an avenue to future-proof against emerging social engineering techniques.
Traditional implementation of IAL3 involves an on-site verification agent reviewing ID in person – similar to how security guards verify ID before admitting people into some offices. Unfortunately, this approach is both expensive and limits the potential audience for the service.
TrustSwiftly’s hybrid IAL3 identity proofing helps businesses attain a higher level of assurance at lower expense. By combining “something you are” (biometrics) with “something you have” (cryptographic hardware), TrustSwiftly allows organizations to build an impregnable barrier against even the most sophisticated synthetic identities – creating a secure phishing-resistant environment and decreasing cyber liability insurance costs as well as operational expenses through reduced password resets.
Document Verification
Document verification is an integral step in authenticating an identity, verifying that someone is who they claim they are when opening new accounts or making online purchases. Document verification helps prevent fraud and data breaches by assuring that individuals who claim they are are indeed who they claim they are.
This process involves inspecting documents such as ID cards, passports, contracts and certificates for authenticity and tampering as well as checking security features such as holograms, microprinting or watermarks. It may be done manually or automated; in general automated processes tend to be more efficient.
Leading IAL3 compliant solutions utilize multiple verification methods such as chat, video, facial recognition with liveness detection and document authentication to validate that claimed identities and attributes match with reality. This enhances trust while decreasing cyber liability insurance premiums as well as operational costs such as password reset requests. Furthermore, these technologies are scalable, providing low total cost of ownership for CSPs.
Biometric Comparisons
Biometrics provide an inherently unique identifier that cannot be lost or forgotten, making them harder to hack into or falsify than digital identities and potentially helping reduce impersonation and fraud. When combined with claimed digital identities, they can help minimize impersonation attempts as well.
The NIST 800-63A IAL3 process includes direct observation during verification sessions, document validation against reliable sources and biometric comparison with claimed digital identities to ensure strong phishing resistance. Furthermore, a hardware-backed authenticator may provide extra protection from SIM swaps or MFA bypass attempts.
Adaptive biometric systems are an exciting research area with great promise, as they can automatically adjust to intra-class variation of operational data. This can dramatically decrease training data requirements needed to create an accurate system.
TrustSwiftly can provide a scalable, secure solution to meet IAL3 requirements, such as step-up reproofing based on risk, in person or remote credential issuance, facial image captures with liveness detection support, ID&V evidence types with different validation strengths (weak to superior), enrollment code distribution to an address of record either physically or digitally and notification of proofing to said verified address of record.
Liveness Detection
IAL3 employs an invisible and passive liveness detection process, which serves to verify that users are real humans and prevent fraudsters from employing fraudulent techniques such as masks, photos or video, AI deepfakes in presentation attacks.
Light interaction with skin, micro-expressions and voice patterns are analyzed in order to detect liveness. Criminals will find this harder than using active methods that require them to complete tasks themselves; additionally it protects against SIM swaps and MFA bypasses.
Businesses could implement this process using physical proofing agents who will examine individuals in a controlled environment, similar to how security guards inspect visitors before admitting them into certain offices. Alternatively, kiosks attended by agents could also be utilized; either way, it’s important that users are fully informed as to how their liveness data will be utilized before participating in verification sessions and remain up-to-date on its use throughout.
