678 VIEWS
Pinterest LinkedIn LINE

On June 21, I will hold a workshop titled “Identity in Conflict” at Identiverse 2022, near Denver, Colorado, USA.

Identity in Conflict

  • Tuesday, June 21, 11:30 am – 12:20 pm MDT (Japan time: 2:30 AM – 3:20 AM)
  • In times of instability and uncertainty, the reliability and trustworthiness of our identity systems become especially important. This workshop examines two areas in particular—identity management for displaced people, and the protection of government identity systems—and seeks to establish some ground rules to ensure that critical identity systems are robust and fit for purpose.

I proposed this session to the organizers in response to the invasion of Ukraine that began on February 24, and they made it happen. I am deeply grateful to the organizers for squeezing it into a program that was already full.

The challenges of identity in conflict fall broadly into the following 2 categories.

  1. Identity management for displaced people
    1. How to provide them with aid and other services, such as banking
    2. How to protect displaced people and those around them from targeted misinformation
  2. Identity management for government-related systems
    1. How to withstand enemy attacks and protect the systems of governments and aid organizations
    2. Business continuity and recovery strategies

Each of these topics could be discussed at great length. Unfortunately, we have only 50 minutes, and a person responsible for defending government systems has unexpectedly been able to travel to the United States and join the session, so I expect we will focus primarily on item 2.

Since the invasion began, phishing and similar attacks against the Ukrainian government have increased by 3000%. Assistance has arrived from many quarters in response, including Yubico’s shipment of 20,000 YubiKeys. At the same time, the cryptographic algorithm currently used by the Ukrainian government was developed under GOST (the Russian counterpart to NIST). Taken together with information from a certain source that almost every government system has already been hacked, this gives us much to think about.

If you are coming to Identiverse, please join us.

(Added later: Session summary)

Watch this video on YouTube.
Playing the video connects to YouTube.

Identity Management and Cybersecurity in Conflict

This briefing document summarizes the main themes, key ideas, and facts from excerpts of a panel discussion on identity management and cybersecurity in the conflict in Ukraine.

1. Introduction: Collaboration to Support Ukraine

Several organizations, particularly the OpenID Foundation and the Financial Data and Technology Association, are working together to make a systematic and meaningful contribution to Ukraine. At the heart of this effort is support for building “modern digital infrastructure with identity at its core,” looking beyond the conflict’s current circumstances toward the future.

“It is about helping countries like Ukraine build modern digital infrastructure by looking not only at the present situation, but beyond the horizon. That will enable them to develop banking systems and more with identity at the core.”

The panel discussion is led by Nat Sakamura of the OpenID Foundation, with John Bradley of Yubico also participating.

2. Two Major Identity Management Challenges in Conflict

The presentation divides identity management in conflict into the following 2 broad categories.

2.1. Identity Management for Displaced People

Identity management for displaced people involves several difficulties.

  • Difficulty verifying identity: “Verifying basic identity information such as names and dates of birth is often a problem.”
  • Rebuilding life in a new place: It is difficult to establish the information needed to obtain bank accounts, phones, electricity, housing, and other necessities.
  • Reestablishing professional qualifications: Many people flee without diplomas or professional certificates, making it difficult to reestablish their qualifications.
  • Targeted attacks and the spread of misinformation: Displaced people risk being targeted using collected and observed attributes and exposed to misinformation and disinformation. The problem is especially serious when they flee to a country where their native language is not spoken.
  • Yuri Eckerman says, “In the current situation, where Russia is detaining Ukrainians, forcibly transferring them to Russia, and placing them in filtration camps, identity information has enormous significance. Even having served in the military decades ago can be grounds for detention and can ultimately lead to someone being killed.”
  • Attacks on aid agencies: Incidents include the theft of aid supplies through fraudulent identification and impersonation, as well as terrorists infiltrating refugee communities.
  • The varied circumstances of displaced people: A range of scenarios must be considered, including refugees staying in supporters’ homes, refugee camps, and oppressed and forgotten people within the country.

2.2. Identity Management for Government and Critical Infrastructure Systems

Protecting government and critical-infrastructure systems is an especially urgent challenge in Ukraine as cyberattacks intensify.

  • Defense against hostile attacks: It is vital to know how to respond to attacks on systems and protect those systems.
  • Authentication and provisioning challenges: There are challenges in user authentication and user provisioning.
  • Remote access from unusual locations: Remote access from locations outside the norm must be managed.
  • Algorithm considerations: The choice of cryptographic algorithms is also important.
  • Business continuity planning (BCP) and data backups: A BCP for backing up data in a secure location and restoring systems is essential.
  • Yuri Eckerman emphasizes the importance of data protection: “Before the war began, many government services and private companies had moved their backup systems to secure locations in the EU. As a temporary measure, they also proceeded with migrations to cloud services such as G Suite and Azure.”

3. Current State and Challenges of Cybersecurity

The discussion focuses on the current state and challenges of cybersecurity in Ukraine, particularly the increase in phishing attacks and Russia’s cyber capabilities.

  • Dramatic increase in phishing attacks: Although the types of attacks have not changed, with 80–90% consisting of phishing and password brute-force attacks, the number of attacks has “increased by a factor of 500 to 1000.”
  • In 2021, one critical-infrastructure provider reportedly experienced 21,000 security events over the entire year; in the 1 month after the war began, the figure surged to 760,000.
  • Evolution and limitations of Russian cyberattacks:
  • It has been noted that cyberattacks were not sophisticated early in the war because rocket attacks were easier than hacking.
  • The attacks have become more strategic. Password brute-force attacks, for example, have grown more sophisticated by spacing out attempts instead of making many in a short period.
  • Yuri Eckerman, however, points to their limitations, saying, “Physically, Russia does not have sufficient cyber capabilities compared with China.”
  • Russia’s cyber sector faces a brain drain of skilled people, creating a situation in which “even cybercriminals do not want to cooperate with the Russian government.”
  • Sanctions have made it difficult to obtain servers and other hardware, significantly constraining Russia’s cyberattack capabilities.
  • The Russian military’s hacking groups have been described as “for the time being, like so-called script kiddies—unskilled hackers who merely use tools made by others.”
  • Strengthening Ukraine’s cyber defenses:
  • Over the past 8 years, Ukraine has learned the need for cyber defense and advanced its countermeasures.
  • Compared with Russia’s massive power-outage attacks in 2015–2016, Russia’s current attacks have not been very successful.
  • Fundamental policy changes within the government, including the creation of regional SOC (Security Operations Center) teams and a coordination center, have produced strong collaboration.
  • Large-scale support from Microsoft and other security vendors has also contributed substantially to stopping malware attacks.
  • Expressing gratitude for international support, Yuri Eckerman says, “The Ukrainian government states very transparently that all the people providing support are a major reason Ukraine still exists.”

4. Specific Examples of Support and Their Challenges

Yubico’s donation of security keys is one concrete example of support.

  • Yubico’s support: Yubico initially donated 20,000 security keys and later added another 10,000, providing Ukraine with “a total of 30,000 keys.” This also includes technical support, such as translating deployment guides into Ukrainian.
  • Deployment challenges:
  • Compatibility with existing infrastructure: Many Ukrainian systems run Active Directory rather than Windows 11, so existing non-FIDO infrastructure, including smart-card support, must also be accommodated.
  • Complexity of deployment: Tasks that are complex even under normal conditions, such as deploying Microsoft certificate servers, become more difficult amid continuous attacks and physical threats.
  • Salary support: Efforts are also underway to supplement IT administrators’ salaries so they can continue their projects while covering their living expenses.

5. Challenges in Identity Technology and the Importance of Localization

The panel discussion emphasizes the importance of standardization and localization in identity technology.

  • Use of outdated algorithms: Ukraine and other countries in the former Soviet sphere may still be required to use Soviet-era algorithms such as GOST. This creates the ironic situation in which a party under attack is forced to use technology from a former enemy state.
  • Need for unified standards: Distrust of NNSA and NIST algorithms creates a need for broadly accepted standards, such as ed25519, that can meet the requirements of different countries.
  • Importance of localization:
  • Yuri Eckerman points to the information gap outside the English-speaking world, saying, “Where we are failing as an identity community is in localization.”
  • Beyond translating technical documents and guides, it is essential to “localize” solutions by taking into account local social structures, government organizations, and infrastructure conditions such as electricity and internet connectivity.
  • Even basic terms such as “the YubiKey touch sensor” may have no suitable Ukrainian translation, requiring careful wording adapted to the culture and level of understanding.
  • In Ukraine, the choice of identity solution is “literally a matter of life and death for some people,” leaving no room to experiment with questionable solutions.

6. Ukraine’s Cyber Resilience and Future

Ukraine continues to maintain its digital infrastructure and the lives of its people even amid the conflict.

  • Resilience as a digital state: Ukraine’s success is attributed not only to military reforms, but also in large part to the robust development of its digital identity framework.
  • The smartphone app “Dia” integrates “everything in government into one app,” enabling people to obtain passports, open bank accounts, apply to universities, and more.
  • This digital infrastructure allows many Ukrainians to receive pensions, apply for new certifications, and attend school online even when their cities have been destroyed.
  • Impact on the international community: Yuri Eckerman says, “The more you help Ukraine, the more Ukraine will protect all of you, all Western countries,” suggesting that successful models of cyber defense in Ukraine will help improve cybersecurity internationally.
  • Future goals and requests for support:
  • Heidis Group aims to make Ukraine “the most cyber-secure country on Earth.”
  • It has set a goal of deploying 100,000 security keys and is seeking additional financial assistance beyond the 30,000 donated by Yubico.
  • Support is also needed to hire engineers, fund solution engineers, provide hardware such as laptops and servers, and supply physical equipment such as bulletproof vests and helmets.
  • Cyber help website: A cyber-help website (cyberwar.com.ua) will be launched to transparently disclose what Ukrainian ministries need and to support the donation process.

7. Conclusion

The conflict in Ukraine has highlighted the importance of identity management and cybersecurity. It presents a wide range of challenges, from supporting displaced people to protecting a nation’s digital infrastructure. International cooperation—particularly technical support and attention to localization—is essential. Ukraine’s resilience demonstrates that robust digital identity is vital to a nation’s survival, and its experience offers valuable lessons for cybersecurity strategies across the international community.

Related posts

The 7 Laws of Identity—Seven Laws of Identity

Kim Cameron, who left Microsoft on May 5 this year(*1), formulated the “7 Laws of Identity (Seven Laws of Identity)” from discussions with the “Identity Gang.”…

Identity · 2011-05-31