The Innovative Advantage in Digital Customer Experiences

Businesses have embraced digital to engage with their customers. Keeping pace in this rapidly evolving threat landscape requires businesses to look for innovative ways to build experiences that optimise security without impacting user convenience.

Ping Identity and Versent conducted a roundtable luncheon in Sydney and Melbourne in November 2022, with CISOs and related C-level executives responsible for ICT and/or cyber security in their organisations or business units. The aim was to spark thought and engage in a robust conversation about the challenges, issues, and approaches to identity access & management orchestration, with a specific focus on using customer identity to optimise security and convenience, especially in the areas of customer and employee experience. Twenty-eight executives from a very broad range of industries and backgrounds attended the event.

Steve Dillon, Head of APAC Architecture at Ping Identity, and Eddie Smith, GM Identity and Security at Versent hosted the events. Both 2.5-hour events were moderated by Craig Baty, Principal of DataDriven.

Leaders must collaborate with teams across the business to develop and execute a customer-facing digital strategy that ensures a frictionless experience, enhanced security, protection from fraud, and regulatory compliance. Using customer identity, leaders can establish a firm foundation of collaboration with different stakeholders to orchestrate digital experiences that drive sales, lower fraud losses, and meet business objectives.

Cyber security has always been topical but continues to increase in importance.  Recent research from DataDriven’s survey of 125 Australian ICT Decision makers, published by the Australian Information Security Association (AISA) shows that cyber security featured as the number one challenge for ICT organisations in the last two years. This outpaced the issues of cost control and revenue generation. At the same time improving customer and employee experience dramatically rose in importance.

In the same month that this series of events was conducted, Australia experienced an unprecedented number of cyber security challenges including attacks on Optus, Woolworths, Medibank/AHM, the AICD event, and more. Whether these were conducted by individuals, nation states, or organised crime, the threat has become incredibly real to the Australian population in general.

One of the key reasons for this increased number of threats is the dramatically increased size of the threat landscape or footprint caused by the rapid increase in the number of people working from home or working from anywhere. This has created the need for authentication at all levels.

This increased threat level has also led to a change in the typical way in which organisations viewed cybersecurity. The mantra of “always trust but verify” is rapidly being replaced by that of zero tolerance and a mantra of “never trust always verify”.

After asking each of the attendees to share what they thought IAM orchestration meant, and briefly discussing their organisation’s understanding of the topic, we shared Ping’s definition as follows:

“Orchestration platforms provide control and visibility of your entire identity and access management (IAM) system and all of the processes in place. From registration to authentication, authorisation, risk monitoring, and fraud detection.”

Surprisingly, out of the twenty-eight organisations participating in this round table, only five believed they had mature IAM orchestration implementations.

At least 60% were at the stage of thinking about it, around 15% were in the planning stages and 15% had active proofs of concept (POCs) underway. Many of them stated that the roundtable topic was appealing because it came at the exact time when cyber security had surfaced as a key priority for their organisation. So, attendance at this event was a key informer for their plans, with a number directly stating that they found the discussion extremely valuable and timely.

Almost all industries were represented at the event including financial services, healthcare, primary industries, manufacturing, retail, wholesale, transport and logistics, education, public sector, energy/utilities, and NFPs including religious and charitable organisations. A wide range of challenges in the cyber security area, especially identity management, were raised. A number of industry-specific examples are listed below:

Universities: in the university context research databases are under constant attack. These databases store extremely important research conducted by students and research professionals. This includes valuable IP. These databases are on the cloud or on-premise. In many cases, there are 20 years of data stored.

Primary industries: are staffed by a significant number of part-time workers. There are regulatory and OHS requirements to keep track of the workers, including their visa status, emergency contact details, number of hours worked, locations of work and much more.  In many cases, organisations have difficulty doing this especially as the workers may be distributed over extremely large areas of a farm or cattle station. This means that employers often have no idea who was on site and how long they were there. Most of them are working in an offline environment with no connectivity possible. Synchronisation of the data does not occur until people are back in the accommodation or back at the local headquarters of the organisation.

Health organisations: had some specific challenges as well, with multiple systems and access points spread across multiple hospital campuses, surgeries, and other facilities. Access via facial recognition (masks) and fingerprint (gloves) makes identification that much more complex.

Aged care facilities: face the challenges of keeping track of patients who leave the protected environment but may not be in a fit state to officially leave.  Tracking, locating, and identifying them without violating privacy rules and conforming to other regulations is a particular issue.

Long-distance road and rail transport services: face the issue of long periods of no connectivity (up to 3 days in cases), meaning that checking of correct stock and goods loading, and the identities of those accessing offline databases is also fraught with risk.

Not-for-profits and charities: face challenges around the cost of keeping their equipment, software, and general IT support up-to-date and maintained. This hampers implementation and management of cyber security.

Manufacturing: organisations had a large number of blue-collar workers, who were generally averse to extra compliance requirements. Strong perceptions around IAM authentication and verification and invasion of privacy posed special obstacles to enterprise-wide implementation.

A number of other challenges were discussed by attendees as follows:

• Password length is growing, to the extent that some organisations require fifteen or even 25-word letter passwords (often required for cyber insurance). This trend is increasing internal resistance to cyber security in general, however, an effective IAM strategy can mitigate these challenges. However, one respondent suggested that the easiest approach is to just create a sentence, with some kind of pattern for remembering and rearranging the password as required. This will make it easier to remember but difficult to crack.

 

• Although mentioned above as a specific challenge for the primary industry attendees, the requirement to support staff who may be offline workers for long periods, also exists across many other organisation types and was brought up a number of times.

 

• Another challenge is that the whole concept of IAM and orchestration in particular can be very confusing for organisations especially those with smaller numbers of cyber security staff. Some attendees mentioned difficulty in finding an organisation that can help identify overarching requirements and then independently advise on an end-to-end basis, from the creation of the business case through to implementation and ongoing management. Comparing providers was also found to be difficult with many organisations facing similar challenges.

 

• Skills and resourcing challenges were also quite topical. A key issue was around obtaining and maintaining skills. The discussion centred around what kinds of people you should employ and whether an organisation should hire fully qualified university graduates or those with micro-credentials no matter what the qualification. Most agreed that the most important criteria were not the qualifications, but that the attitude and approach to problem-solving were much more important.

   

  • Traits such as curiosity, questioning thinking, persistence, creativity and the ability to track down issues and follow through were seen as key. The ability to communicate and work with others was also seen as more important than specific qualifications. One attendee said that he was more interested in what the candidate did on the weekend, what they read, what their hobbies and interest are, as well as how they apply their knowledge, rather than the actual qualifications they have.

It is often not immediately obvious to decision-makers what the benefits of IAM orchestration will be, or why it is even under discussion.

One idea for obtaining justification for identity orchestration is to put the words ‘cyber security’ as the focus rather than just the words ‘identity management. This will get attention however, this strategy could backfire if the previous security plan had failed.

Another organisation agreed with the last sentence and stated that using identity management as the core focus to drive the business case was not really appropriate in their organisation. The thing they focused on was increasing the customer experience, increasing the level of access for clients and end users, and driving the overall digital transformation process. A related point was that having a focus on making things more efficient does not necessarily work but making something better or easier is extremely important to highlight.

Another approach is to position identity access and management as an enabler of digital transformation and enhanced cyber security, which may enhance the chance of obtaining stakeholder buy-in. Other quantifiable outcomes especially in an online shopping environment could be increased registrations, reduced cart abandonment, reduced fraud, and reduced customer acquisition costs among others.

A key challenge is getting all the stakeholders together across multiple business units to identify requirements and agree on a plan. This point was highlighted by the majority of attendees. Some organisations are more complex than others, so the cross-functional team could be a combination of full-time staff running various business units and sections, plus contractors and remote staff, and the cyber security service provider and IAM solution provider as required.

One organisation faced difficulty even getting senior management’s attention. At the board level, no one was really interested in the details or what was happening. The only requirement the board had was the answers to questions such as ‘are we safe’ or ‘are we good’. Getting them to understand what was truly required or even putting cyber security and IDM on the agenda, was almost impossible.

During discussion, one attendee suggested that if there was this type of resistance that the issue should be formally raised to the ‘risk committee’, which should stir some action at board level as it is a legal requirement for them to escalate any identified risk to the board. If this did not work, the next step would be to notify their insurance company of potential risks, which would in turn cause action at board level. However, this last option was viewed as a last resort due to potential career-limiting outcomes.

Another organisation was successful in getting board support, by asking the board and senior management to work through an event scenario, where the systems became unavailable due to a cyber security breach. They tested whether they could run the company without any systems being available at all and for how long. They then estimated the cost of recovery and the impact on the business and economic cost.

In a related theme, a large organisation actually experienced a complete loss of systems for many weeks. Since then, they have had no challenges getting stakeholder approval. This incident resulted in almost every single computer, laptop, and PC in the organisation being infected. They eventually found one laptop that was not infected from which they were able to start rebuilding the system. Since then, they have adopted a significant cybersecurity stance and added additional protocols which are very strict.

A common theme around stakeholder engagement was the time taken to get through a significant number of internal silos and bureaucracy. One organisation found a senior leader who understood the issues. Working with them, they developed an ROI document which the leader endorsed. The focus of the ROI document was in terms of what could go wrong, and then how to mitigate these issues. They then developed a critical deliverables list.

As part of this process, they ran a design thinking workshop, combined with user experience (UX) input, and customer experience requirements (CX), and related this to their digital transformation (DX) needs. The result was a total of experience (TOE) definition and requirements. Based on this process they were able to define the benefits across all these areas, and then develop a final ROI document and deliverables plan, which enabled them to present a cohesive request to the stakeholders. As all teams and most stakeholders were involved in the process, the final approval was relatively straightforward.

Another commonly mentioned challenge was that of balancing the level of security required with the overall customer or employee experience.

For example, one organisation mentioned that the union viewed the requirement to have multi-factor authentication or even a simple password, as being over and above what their employees should be required to do. Many staff did not have a company-provided mobile phone and were worried about receiving authentication on their mobile phone, as they saw that as a violation of personal privacy. However, the organisation then pointed out that all supervisors and staff already communicate via mobile, to advise on location, coordinate work, and other matters such as notification of sick days, etc. No personal data (apart from mobile numbers) was collected during this process. Once it was pointed out that (in this case) the system was based on SMS authentication, they concluded that this was not invasive and would not violate their privacy as they were already using this technique. A number of other similar examples of internal resistance to IAM were also mentioned.

Another strategy for overcoming internal resistance was to ensure that employees were aware that the whole focus of IAM was on keeping the employees safe. IAM is actually a benefit not a problem, it increases employee safety and reduces risks as the login is associated with them personally so anything that happens with their login relates directly back to them also any breach of the system could result in their personal employee data being accessed. More extreme solutions were based on ‘no compliance = no work’.

Engaging all the digital teams in the organisation in developing the right personas and getting them correct was also raised as an issue in improving customer experience. To get the personas right, one suggestion was to make them all human-centred and start by looking at what people were logging into, what they needed to login to, and how to approach access. From there they were able to build user profiles and engagement models very swiftly. This then enabled grouping the data in terms of who needed what. As part of this process, they surveyed and consulted their users and the customer service staff. They also interrogated their communications data and conducted a number of tech forums with various stakeholders. From there they were able to match the personas, create the regulations, assign access and implement the right level of governance.

Throughout the discussion Steve Dillon (Ping Identity) and Eddie Smith (Versent), contributed many enlightening viewpoints and suggestions, especially in relation to some of the more technical challenges around IAM and CX. 

Key points addressed were as follows:

• Key to ensuring a successful CX and EX is the ability to create and map the user and customer journey in an agile way and provide appropriate levels of authentication via MFA or just a password.

 

• Using a no-code drag and drop interface, Ping can map all aspects of IAM to personas, and include all components and functions including CRM, fraud, single sign-on (SSO), directories, Socials (such as Google and Facebook), all within the cloud. This includes a high level of automation.

 

• Creating a prototype is straightforward using Ping’s no-code approach. This enables a real example of IAM and orchestration to be created and shown to stakeholders as part of building the business case.

 

• Versent in conjunction with Ping can design, develop, implement and manage a wide variety of solutions. One case study shared was for an organisation with a very large number of older Microsoft versions installed. These are supported by MS under special arrangements due to the sheer scale of their implementations. The challenge was to support these older versions and more primitive sign-on capabilities, alongside the most recent MS versions. The solution was implemented rapidly to ensure rapid time to market, whilst at the same time balancing customer and employee experience and convenience with the right level of security and risk.

 

• Another case study mentioned was that of a law enforcement IAM project. This required an end-to-end IAM orchestration project to provide secure access across multiple databases. This was a particularly sensitive project as the database contained the personal address details of judges, undercover police officers and those in witness protection. Secure IAM is critical in these situations.

 

• IAM orchestration can help alleviate cyber security skills shortages as the requirement for management are significantly less with the Ping solution. A team of five could be reduced to 2 for example, as a result of low code development capabilities and high levels of automation.

 

• Change management is also simplified with a well-developed IAM strategy and implementation, which contributes to a better EX and CX.

The discussion was quite vibrant, with very active participation by all attendees. The discussion ranged from providing emergency wi-fi access and supplies in the Australian outback and desert, based on remote railroad maintenance bunkers (and the security issues surrounding that) ...to facial recognition for cows to assist with livestock identification and transport (but not for Llamas for some reason).

However, the biggest and most common challenge was not technical in nature. Most attendees agreed that the greatest challenges to implementing identity access management and inappropriate cybersecurity posture to mitigate potential breaches is people related.

The major limitation to preparing and gaining acceptance for the business case, was stakeholder and other internal resistance, right down to the end-user. There is still a massive requirement for significant education and cultural change across the industry. The aim would be to ensure that everyone understands that the time to implement IAM is now, and that failure to act could be catastrophic for their organisation.

In conclusion, one thing is clear, the threat landscape, volume, and intensity of attacks will increase, not decrease. Attendees were unanimous in their desire to ensure that their organisation was positioned to mitigate as much of the impact as possible. IAM and orchestration are seen as the pointy end of their strategy and have increased as a priority within their organisations. The key is to ensure effective testing, implementation, and management, whilst maintaining or even improving the end user and customer experience, whilst enabling digital transformation and business growth.

Steve Dillon, Head of APAC Architecture, Ping Identity

Steve is an identity security expert who has worked with many of Australia’s leading public and private sector businesses during the past 15 years to support their cyber resilience and effective posture against an ever-increasing array of threat vectors. 

Steve is responsible for working with organisations to underpin their security infrastructure in support of issues ranging from CDR compliance and achieving Zero Trust to providing personalised, streamlined user experiences that allow customers and employees to access critical applications anytime, anywhere. Curious and creative, he is a trailblazer in enabling organisations to support complex security requirements while providing the seamless user experience required of businesses today.

Steve previously worked at Telstra for more than three years in several roles including as Product Owner – Enterprise Identity where he provided foundational IAM capability underpinning the T22 digitisation program. Prior, he was a Managing Consultant at O2 Networks. Both these organisations armed Steve with a winning combination of critical technical and business skills which today are key in achieving customer success right from the start in any identity security program.

Eddie Smith, GM Identity and Security, Versent

Eddie is a respected digital security specialist, with expertise in Cloud Security, Federation, API Security, Security Automation and Identity and Access Management. He has provided digital security consultancy services for over 20 years within organisations including Deloitte, Access360, Agreon, and most recently Versent; a consultancy focused on bringing a start-up mindset to enterprise.

Over the course of his career Eddie has delivered a broad range of services, providing strategy, governance, architecture and design services for complex solutions in leading Australian companies, most recently overseeing the design and initial launch of the New South Wales Digital License and Citizen Identity Platform. Eddie has experience across a range of industries, including Finance, Telecommunications, Retail & Government, providing consultancy across a variety of security disciplines and has observed and contributed to the development of some of the industry’s leading products as the industry has consolidated and evolved.

Craig Baty, Principal, DataDriven

Craig has extensive thought leadership experience across AP/J ICT markets. He is Principal and founder of DataDriven, which specialises in research-based thought leadership and consulting for ICT Strategy, Outsourcing/Vendor Management, Sales and channel enablement, Cloud, Cyber Security, Digital Transformation, Workplace innovation, Cross-Cultural Communications/Leadership, and Managing Virtual Teams across multiple geographies. Craig’s firm is also the AP/J Research Partner for ISG (Information Services Group), the world’s leading ICT outsourcing and procurement research and advisory organisation.

Craig has over 30 years of executive and board-level experience in the industry, including as group VP Gartner Research AP/J; CEO Gartner Japan; Global VP Frost & Sullivan; Exec. GM marketing/CTO of Fujitsu ANZ & Asia; and GM marketing, strategy, and alliances at BT Syntegra. More recently, he was VP of global strategy/VP of digital services at Fujitsu’s Tokyo HQ. As a well-known ICT analyst, Craig has written more than 200 research pieces, presented at over 1,500 events globally. He is active in the ICT community as a board member of the Australian Information Industry Association (AIIA).

Craig holds an MBA in International Business/Marketing (SGSM/WSU), is a Fellow of the Institute of Managers and Leaders (IML), Ex. Vice Chair of the Australian Computer Society (ACS) NSW, and on the Federal Board and Executive committee of the Australian Information Industry Association (AIIA). He is in the final phase of a Doctor of Business Administration by research (DBA) focused on the intersection of national culture on the strategic use of and investment in ICT (Australia compared to Japan).