Search
Close this search box.
Facebook Instagram Linkedin

Tag: Digital Certificate

Categories
Data Protection

Digital identity benefits businesses and customers

Companies understand that providing a great customer experience is essential in this digital age. And digital identity is one of the key ways.

However, for many managers, requests for digital identification and the sharing of personal information undermine strategies aimed at facilitating user interaction in operations that involve converting into business through digital transactions.

The common practice of asking customers to confirm their identities at all points of contact has become a stumbling block. This situation affects both attendance and data security.

Isn’t it potentially risky to continue reporting personal data that is considered sensitive? Who might be listening or reading this information? And why provide digital identification to, for example, sign up for a newsletter? What does this have to do with safety?

The challenges in managing digital identities

The questions above highlight two challenges of managing customers’ digital identities.

The first of these is the onerous process for which most security strategies are standardized, making it potentially as difficult, “to buy a replacement keyring for a set of car keys as it is to buy the car itself”.

The following is a confusing view for the customer, where digital validation is often not connected to non-digital validation. In addition, access records for different customer touchpoints are stored in separate locations.

There are many dots, but no way to connect them, this format is still a standard for many companies.

Underlying these challenges is the tension between IT leaders and their marketing colleagues. After all, the former want to protect this data and the latter want to exploit it to improve the customer experience.

Given this, the two perspectives can be difficult to reconcile.

Digital identification: the potential to boost brand value

Today’s Chief Marketing Officers (CMOs) are challenged to drive brand value. That value comes from delighting customers. Customers are often delighted when they feel connected to brands.

However, the possibility of this happening is often related to marketers gaining access to the personal data needed to personalize the customer experience.

When done right, these personalized experiences can build not only trust, but also brand advocacy.

Imagine for example a soccer player loyal to a certain brand. Because this brand has earned his trust, he shares personal information that he wouldn’t necessarily share with other soccer brands.

The customer experience, the emotional connection created, the perceived brand value, these things are now inseparable and dependent on digital identity.

Digital identity is the fuel for customer engagement. It is also a source of great concern for CIOs, CISOs and IT teams responsible for ensuring the security of sensitive information, such as digital identities.

But while these points for customer experience and security seem contradictory, they don’t have to be.

After all, there is a converging path. What marketing and technology teams need to better and more confidently serve customers is a way to see and connect the dots. One way to do this: risk-based digital identity authentication.

Four principles of risk-based digital identity management

Business and IT leaders should consider the notion that customer identity is not just about security.

Instead, they can think of it as a feature that can also be flexibly applied across multiple platforms and tailored to individual marketing moves and preferences, as well as making it less obvious to customers.

Marketing and IT leaders can help each other by working together to design a system with four well-defined characteristics.

1. Context dependency

Companies using a flexible approach may, for example, require multiple means of authentication for financial transactions, but at a lower level of verification for interactions such as updating a newsletter subscription.

This type of risk-based authentication has the potential benefit of improving the customer experience and reducing complexity for the organization.

CipherTrust DataSecurity Platform Archtecture

2. Transparency

Rather than standing out as a separate, onerous activity, risk-based authentication can be an integral part of the online experiences customers already engage in, such as searching, buying, servicing or registering.

Getting rid of CAPTCHAs or remembering the name of something favorite at every step of the customer journey is only part of the change.

After all, in this view the initial setup of customer identity profiles is more comprehensive and expands beyond just a few obvious tests, so that fewer visible authentication steps (if any) are required once the customer engages.

3. Personalization

The digital age has allowed us to define choices: one customer may like to authenticate through a secure password manager, while another may prefer biometric recognition.

Combine this ability to choose with an identity-based relationship management system capable of applying these preferences across time and platforms, and the result can be an experience that encourages customers to engage with a brand more often and more willingly.

4. Omnipresence

Any customer-friendly digital identity system should work consistently across marketing platforms, e-commerce, management and communication tools, so that customers do not have to deal with different authentication requirements for different parts of the business.

By working together to ensure this is the case, marketing, IT and other leaders can help deliver a unified and secure user experience, thereby beginning to build brand loyalty and trust.

Generating digital identities

A digital identity can be created through a digital certificate issued by a Certification Authority (CA), based on asymmetric cryptography.

The certificate contains data that is associated with a user or device (for example, its name or the copy of the public key).

The use of digital certificates has many benefits for organizations, for example:

  • Ensure legal compliance;
  • High degree of security, protecting information and reducing the risk of fraud;
  • Increased user and customer confidence.

In turn, digital certificates can be used together with digital signature software to generate digital signatures. In addition, identity management becomes a priority issue for organizations.

Digital identity through digital certificates already a reality

You need a system that allows you to associate and unify your data, provides access to all the systems that must use it and, above all, offers a high degree of privacy and security.

Digital identity transformation is more than just implementing new security technologies and tools. After all, it also involves systemic changes, from the core functions of information security, marketing and services to areas such as governance, finance, culture, even business model.

In some countries, digital identity is fully consolidated and has many applications in everyday life. Perhaps the most striking example is Estonia.

This small Baltic country of 1.3 million inhabitants introduced the digital identification system based on the national register and the national digital identity document in 2002.

This document, mandatory for those over 15, allows its citizens to vote, buy public transportation tickets, encrypt emails, renew their passport, access their medical records, sign documents and perform almost any kind of administrative management online, anywhere at any time and allowing users to own their own data.

But the Estonian system is just a taste of things to come. After all, the number of market participants connecting online is expected to grow exponentially in the coming years.

Thanks to the development of the Internet of Things, millions of objects (from refrigerators to internet-connected containers) will predictably start operating simultaneously and integrated. This will also require setting standards to verify their identities.

About Eval

EVAL has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and the General Data Protection Law (LGPD). In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Storing digital certificates is vital for companies

How do you store digital certificates and cryptographic keys while guaranteeing company security? No doubt the way is always through the adoption of good practices.

That is, the storage of digital certificates and cryptographic keys provides a critical security layer that protects all of a company’s virtual assets.

Breaches due to trust-based attacks are caused precisely by inadequate storage and mismanagement.

When successful, an attack carried out against a digital certificate can have disastrous effects for any organization. Besides security aspects, expired certificates cause great losses in lost business.

Therefore, it is not enough to implement a policy for the use of digital certificates and cryptographic keys: it is also necessary to assertively develop storage and management processes.

Read on to learn more about digital certificate storage.

Digital certificate storage and trust-based attacks

As you know, digital certificates and cryptographic keys are essential for business. After all, they protect data, keep communications private, and establish trust between communicating parties.

In practice, digital certificates are used for several purposes. These include identity verification, file encryption, web authentication, email security, and software signature verification.

Despite their importance, many companies are vulnerable to breaches because they allow the management of certificates and cryptographic keys to be seen as an operational problem, rather than as a security vulnerability that needs to be fixed immediately.

In fact, there is much more a flaw in the policies and processes for storing digital certificates than a vulnerability caused by the absence of security updates or bugs that can compromise any kind of technological structure of an organization.

After all, hackers focus on cryptographic keys and certificates as attack vectors. With bad intentions, they steal them to obtain a trusted status, and then use this to avoid detection and bypass security controls.

The attack happens precisely when the breach of trust occurs

Cybercriminals use trust-based attacks to infiltrate companies, steal valuable information, and manipulate domains. In other words, if private keys used to sign a digital certificate fall into the wrong hands, the system can be breached and the site taken down.

When these cryptographic keys are lost, significant time and energy is wasted accessing systems or renewing certificates.

To give you an idea, if the code signing certificates used to sign an iPhone or Android application, for example, are compromised, an unauthorized developer could launch malware with the help of the breached corporate identity.

In order to reduce the risk of trust-based attacks, digital certificates and cryptographic keys need to be protected and stored securely. This prevents them from being lost or falling into the wrong hands.

Digital certificate storage options and best practices

Every time a digital certificate is issued, a key pair – private and public – is generated.

Without a doubt, the best practice is to keep the private key secure.

After all, if someone can use it, they can create phishing sites with your organization’s certificate in the address bar, authenticate on corporate networks pretending to be you, sign applications or documents in your name, and read your encrypted e-mails.

In many companies, digital certificates and cryptographic keys are the identities of their employees and therefore an extension of their organization’s identification. Protecting them is equivalent to protecting your fingerprints when using biometric credentials.

You certainly would not allow a hacker to get your fingerprint. So why let him have access to your digital certificate?

Advantages of using digital certificates and signatures

The storage of digital certificates

The most used modalities for storing digital certificates in Brazil are two: A3, in token or card, and A1, in file on the computer or other device.

A3 stored in token

This is a type of certificate that is stored in a cryptographic token, a device similar to a USB stick, which must be connected directly to a USB port on the user’s computer or server where the system will run. Furthermore, it is not possible to copy, otherwise the media will be blocked.

A3 stored on card

This type of certificate is stored on a smart card with a chip, just like the new bank cards. In short, it must be connected to a reader that needs to be plugged into a USB port on the user’s computer or server where the system will run. Likewise, it is not possible to copy, otherwise the cryptographic media will be blocked.

A1 stored in file on computer or other device

It is an electronic file stored in the user’s computer or server where the system will run. It usually has the extensions .PFX or .P12 and does not need tokens or cards to be transported from one side to the other.

A1 cloud storage

With it you can access your certificate and digitally sign documents through any device: desktops, smartphones and tablets. Finally, you also gain in security and eliminate the worry about physical damage, theft, and loss.

Don’t lose your digital certificates

In summary, the storage of digital certificates needs to be efficient and treated as a priority in the organization.

The choice of the best way to store will depend on the security policies and processes implemented in the company, and especially on who uses the certificates and what they are used for.

In this way, any regulations your company needs to comply with, costs and internal resources will be secured by storing the digital certificates.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Digital Signature

Learn how the Digital Signature works

Don’t confuse it with a digital certificate! This is the first step in learning how the digital signature works. It serves to validate the authenticity and integrity of a message, software, or electronic document.

Equivalent to a handwritten signature or stamped seal, the digital signature offers security and authenticity in electronic form. It is aimed at solving problems such as tampering and representation in digital communications.

If you still have doubts about the efficiency of the digital signature in your business, check out this post and clear up any doubts about how it works and the advantages of adopting this feature in your company.

The strategic value of digital signature for companies

For enterprises these solutions provide guarantees of evidence of origin, identity, and status of electronic documents, transactions, or messages. In addition, it also guarantees recognition and authenticity of what has been digitally signed.

To get an idea of the efficiency of digital signatures in companies, we can look at the United States. After all, there digital signatures have the same legal significance as more traditional forms of signed documents.

The U.S. Government Printing Office regularly publishes electronic versions of the budget, public and private laws, and congressional bills with digital signatures.

What’s behind the digital signature

Basically, digital signatures use public key or asymmetric cryptography to be created. A public key cryptography involves a pair of keys: one public and one private.

The two keys are mathematically related. The public key, as the name implies, is open and available to anyone who wants to access it. It can, for example, be stored on a public key server.

On the other hand, the private key is kept in a secure company environment, it will never be transmitted publicly. The sender of an electronic document uses his private key to encrypt that document, this is the digital signature.

Finally, the receiver then decrypts the signature with the public key to verify that it matches the attachment. In addition, the private keys are unique to each user, providing verified authenticity to the sender’s message.

Only the sender’s private key can be used to create the digital signature. The corresponding public key is used to confirm this signature, for which the digital certificate is used.

The use of digital signature optimizes investments and increases productivity

A digital signature can be used with any type of message, whether it is encrypted or not. It is used so that the recipient can be sure of the sender’s identity and that the message has arrived intact.

In this way digital signatures make it difficult for the “signer” to deny having signed something (non-repudiation). After all, the digital signature is unique for both the document and the signer.

The digital certificate contains the digital signature of the certificate issuing authority and binds a public key to an identity, and can be used to verify that a public key belongs to a specific person or entity.

Most e-mail programs, Internet browsers, and text readers, such as Adobe Reader, support the use of digital signature and digital certificate. This makes it easy to sign any outgoing email and validate incoming messages, or other types of digitally signed files.

Digital signatures are also widely used to provide proof of authenticity, data integrity, and non-repudiation of communications and transactions over the Internet.

6 benefícios mais importantes da assinatura digital
 

You can reduce costs with digital signature

By migrating their business processes to digital media, companies reduce paper consumption and the costs associated with printing and transporting documents. This strategy allows, for example, to direct what has been saved to strategic sectors of the organization.

And even increase productivity

Besides optimizing investments in the core business, reducing printing costs and using digital media for process automation also increases productivity.

Organizations and their employees no longer perform manual processes and can focus on core activities without having to stop their tasks to print documents or take them to different departments, i.e., it is possible with digital signature to achieve strategic gains throughout the company.

Can any company use a digital signature?

Finally you may be wondering if any firm or organization can get a digital signature. How is it obtained? Is it worth investing in?

To answer this question, it is enough to review the concepts that we saw at the very beginning of the article. In other words, when a user creates a document, he signs it with a unique digital signature and sends it to the recipient.

If the sender’s signature uses a recognized certification authority, in Brazil’s case those that are homologated by the ITI, within ICP-Brazil, the recipient will trust the certification authority to confirm the identity of the publisher. In this way it authenticates the message and provides non-repudiation.

So yes, any person, company, agency, etc. can and should get a digital signature. Moreover, it is a matter of strategic company security. In addition, there are several companies, known as certification authorities (CA), which manage the issue of digital certificates and are approved by the ITI.

As you may have seen, companies can only gain by adopting digital signatures in their business processes.

In the midst of the Digital Transformation era, adopting this technology means that the company as a whole, suppliers, and customers can benefit from strategic efficiency in relation to the sale of products and services.

If you still have any questions about the subject, contact EVAL right now. Our experts are ready to help you overcome your difficulties and start your digital signature adoption project.

About Eval

A EVAL está a mais de 18 anos desenvolvendo projetos nos segmentos financeiro, saúde, educação e indústria, Desde 2004, oferecemos soluções de Autenticação, Assinatura Eletrônica e Digital e Proteção de Dados. Atualmente, estamos presente nos principais bancos brasileiros, instituições de saúde, escolas e universidades, além de diferentes indústrias.

Com valor reconhecido pelo mercado, as soluções e serviços da EVAL atendem aos mais altos padrões regulatórios das organizações públicas e privadas, tais como o SBIS, ITI, PCI DSS, e a LGPD. Na prática, promovemos a segurança da informação e o compliance, o aumento da eficiência operacional das empresas, além da redução de custos.

Inove agora, lidere sempre: conheça as soluções e serviços da Eval e leve sua empresa para o próximo nível.

Eval, segurança é valor.

Categories
Data Protection

Asymmetric Cryptography for Data Secrecy and Protection

When we talk about cryptography, it’s very common to think only of techniques for maintaining the secrecy of information. However, encryption can be used in many other situations. In this post we’ll look at applying asymmetric cryptography techniques to verify the origin of a message.

Asymmetric encryption

Initially, we need to say that one of the most striking features of asymmetric cryptography is the presence of a key pair, with one part public and the other private.

While the public part can be disclosed to all interested parties, the private part cannot. After all, it must be protected and kept secret by the entity that owns the pair, be it a person or a system. From the origin of a message to its final delivery

This key pair is something very special, because when one of the keys is used to encrypt data, only the partner key of the pair can be used in the reverse process.

And it is this characteristic that makes it possible for various cryptographic schemes to exist in communication between two entities.

Alice and Bob’s messages

To make it easier to understand, let’s use the classic analogy. It presupposes the existence of two users, Alice (A) and Bob (B), each with its own key pair.

Alice and Bob exchange letters (messages) with each other and each letter is placed in an envelope that has a special padlock, which, when closed with one of the keys, can only be opened with the pair’s partner key.

Note that since we have two pairs of keys, one for each user, we have a total of 4 keys that can be used to lock the envelope!

So which key should be used? Well, it depends on which security service you want to implement when sending this letter.

Asymmetric encryption for secrecy

If the desire is to guarantee the secrecy of the letter from the origin of a message, Alice must lock the padlock with Bob’s public key. In this way, the only key capable of opening it is the partner key, i.e. Bob’s private key.

Remember that Bob’s private key, by definition,must be known only to Bob. This way, only Bob can open the padlock on the envelope and take the letter out.

Asymmetric encryption for the origin

If she wants to verify the origin of a message or letter, Alice can lock the envelope using her private key. Thus, the only key that opens the envelope is the partnership key, i.e. Alice’s public key.

Remember that Alice’s public key, by definition, is public knowledge. This way, everyone could open the envelope using Alice’s public key.

Note that in this situation, although the letter is in a sealed envelope with a padlock, the contents are not secret. After all, anyone can open the lock on the envelope using Alice’s public key.

What is required is verification of the origin of the letter (or the sender’s authorship). In other words, for Bob to check if the letter came from Alice, all he has to do is open the padlock with her public key.

Note that in this situation, although the letter is in a sealed envelope with a padlock, the contents are not secret. After all, anyone can open the lock on the envelope using Alice’s public key.

What is required is verification of the origin of the letter (or the sender’s authorship). In other words, for Bob to check if the letter came from Alice, all he has to do is open the padlock with her public key.

Hybrid Infographic HSM

Symmetric encryption

It is interesting to note that the secrecy service could also be implemented with symmetric cryptography (that which has a single key). After all, it’s much faster.

It is therefore common to see security protocols that use hybrid schemes with symmetric and asymmetric cryptography to implement confidentiality, origin verification, authentication and irretrievability services, taking advantage of the benefits of each: the speed of symmetric cryptography and the flexibility of using asymmetric cryptography.

Finally, after all this explanation, at least one question remains open: how does Bob know for sure that he has a copy of Alice’s public key and how does Alice know for sure that she has Bob’s public key?

The way to trust someone’s public key is to get a copy of it from someone you trust. You need a mark on the key that says: “this is so-and-so’s public key”.

The combination of the entity’s public key and the entity’s identifying information is called a digital certificate, a topic for another post.

We’ve also written an article that may be of interest to you, as it talks about data encryption and its importance in the financial market, click here.

Subscribe to our newsletter and stay up to date with Eval news and technologies. Keep following our
blog content
 and taking advantage of
our Linkedin profile
.

About Eval

EVAL has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Where We Are

Rua Paulistânia, nº 381, 2º andar,
Sumarezinho
São Paulo - SP,
ZIP CODE: 05440-000

Contact

(11) 3670 - 3825
(11) 3865 - 1124
[email protected]

Facebook Instagram Linkedin
logo-tales-azul
keyfactor-logo
logo-valid-certificadora-digital
google-safe-browsing
Privacy Policy

Copyright © 2023, EVAL TECNOLOGIA EM INFORMÁTICA. All rights reserved - CNPJ 05.278.889/0001-97