How Digital Identity Drives Innovation and Security for Retailers

Read Time: 24 minutes

Introduction

Retailers face no shortage of fresh, innovative competitors. Newcomers in online and brick and mortar retail alike are stepping up their game and aiming to steal your market share. If they provide more convenient and engaging experiences, today’s fickle customers won’t hesitate to shift their loyalty.

To stay ahead of the curve, you have to embrace innovation and provide customers with omni-channel engagement that matches their lifestyle. Customers expect to move seamlessly from channel to channel with consistent experiences and personalization.

At the same time, you have to be a good steward of the data your customers share with you. You must protect their data—and your brand reputation—from breaches, but also enforce customer consent and give them insight into how you’re using their data. Loyalty and trust are tied closely together. If you lose your customers’ trust by mistreating their data, their loyalty will soon follow.

“Seventy-five percent of consumers expect consistent experiences across multiple channels (web, mobile, in-person, social), with 73% likely to switch brands if they don’t get it.”¹

Providing secure, seamless customer experiences across channels is just the first step. You must also be supported on the back end by premium products and top-notch service from your employees and supply chain partners. That requires providing those users with the same level of secure, seamless access to the applications and technologies they need. Insecure or inefficient processes around employee and partner access will add friction to the engine powering your retail enterprise.

A modern identity and access management (IAM) platform is key to securely enabling engaging customer experiences, while streamlining employee and partner interactions at scale. An efficient identity infrastructure will allow you to stay in lockstep with innovation, wow your customers, secure their data and boost employee and partner efficiency.

Leverage Your Technical Experts

Retailers have many options for solutions to help them create omni-channel experiences for customers, employees and partners. A customer identity and access management (customer IAM) solution for retailers can yield immeasurable benefits for your organization.

Many solutions will claim to address your needs, including experience management platforms, marketing automation software and CRM software. But the capabilities of these products can vary dramatically and may not match your needs or expectations. A best-in-class retail customer IAM solution will help you achieve scalability to millions of users, provide multiple layers of security and allow for creation of a unified customer profile accessible by all applications.

How do you know what solution is best for you? The answer to whether a solution can deliver your desired results is often found under the hood. This is where you can leverage the expertise of your IT and security teams to determine how well these solutions will work with your organization and infrastructure.

Your technology counterparts will help ensure that you won’t have a system outage on Black Friday or Cyber Monday. Your security team can confirm that the method of encryption or other security features don’t leave vulnerabilities for hackers to leverage. You can also lean on your in-house technical experts to evaluate solutions and determine whether or not the unified profile you expect can be achieved in your enterprise or hybrid IT environment.

The solution you choose will have lasting impact on revenue, customer loyalty and your market share, so it’s important to collaborate with IT and security teams early to make sure you’re building a solid foundation.

Drive Loyalty & Growth

To win customer loyalty, retailers must create omni-channel experiences. This requires blurring the line between the digital and physical worlds, and recognizing that today’s consumers have zero tolerance for lags and outages.

If you get customer experience right, you’ll be rewarded with increased customer loyalty and an advantage over your competitors. But if you get it wrong, you risk losing customers to those same competitors.

Creating personalized experiences across channels requires your digital properties to instantly recognize your customers. Each channel needs access to the same set of preferences and data about the customer, so they can deliver consistent personalization. And that’s what identity management solutions do best.

“Today’s digital businesses need deep customer insights to successfully deliver new products and services that can increase customers’ engagement and brand loyalty while maintaining their security and privacy. Customer identity and access management (CIAM), if done well, can help business owners achieve this outcome.”²

3.1

Creating a Unified Profile

If you’ve seen the movie Finding Nemo, you remember Dory, the blue tang fish with short term amnesia, who can’t remember anything for more than a few seconds. Each time one of the characters interacts with her, she asks questions that were already answered and forgets vital information that is relevant to the conversation.

Unfortunately, many applications from large retailers behave this way. Even though a customer just logged in, set preferences or updated personal information in one app, another app from the same retailer has no idea about the previous interaction. Not only does this present missed opportunities for personalization, but the customer may also be inconvenienced with additional login requirements or have an order shipped to an old address.

Creating a unified profile requires much more than surface-level communication between applications, which is typically the extent of the “unified profile” promised by marketing vendors. A truly unified profile is like the cure for Dory’s amnesia. It enables your mobile apps, websites, CSRs and other channels to see the same customer record. It enables consistent sign-on and registration experiences. With a unified profile, all applications and channels can instantly recognize customers and their preferences. This gives customers the contiguous experience of interacting with a cohesive brand, instead of disparate applications.

The concept is simple, but creating a unified profile in today’s retail enterprise environments is anything but easy. The Ping Identity Platform is an enterprise customer IAM solution that enables you to create a unified profile from authentication to the data layer, even in complex or hybrid IT environments.

3.1.1

Unifying the Authentication Layer

Customers must register and login for you to get to know them. Authentication is one of the most frequent interactions they have your brand. Customers absolutely cannot be required to use different sets of credentials for different applications, or be subjected to other inconvenient authentication processes. Getting login and registration right is table stakes, but integrating consistent authentication experiences with all of your retail apps is tricky.

The Ping Identity Platform leverages SAML, OAuth, OpenID Connect and other common standards to achieve federated single sign-on (SSO). This standards-based approach ensures that no on-premises or cloud application misses out on consistent registration and login experiences.

It also enables you to add convenient social login and registration options to customizable templates. Customers can choose to use their social account to register, or they can link it later. Either way, your customers experience convenient one-click login, and you’re able to leverage existing social data to jump-start personalization.

Password resets, the ability for customers to self-manage their own identity data and preferences, secure password policies, and frictionless multi-factor authentication (MFA) are all vital to delivering secure and convenient authentication and SSO to all apps and channels. These processes can be extremely difficult and risky to build from scratch. Ping makes them simple and secure.

Figure 1: PingFederate delivers capabilities that enable convenient and secure login and registration experiences to all applications.

3.1.2

Unifying the Data Layer

Registration and login are just the first steps. Once a customer is logged in, you must continue to deliver convenient, personalized experiences no matter how customers choose to interact with your brand.

The Ping Identity Platform allows you to store and manage customer data in a unified profile, giving you a 360 degree view of your customers. The unified profile acts as a single source of truth about your customers. It can be used to store customer consent data, sensitive personally identifiable information (PII) and credit card data, customer preferences, unstructured data and other information associated with customer identities.

The directory capability of the Ping Identity Platform, PingDirectory is custom-built to store and manage customer identities with the scale, performance and security that large retailers require. Since all the data is exposed through developer-friendly APIs, it’s easy for applications to leverage the identity and preference data to create consistent experiences across channels.

Depending on your environment, you may have some applications that simply can’t be migrated to a unified profile right away. For those cases, PingDirectory includes real-time, bidirectional synchronization capabilities to ensure that even your legacy applications and directories can be a part of your unified customer profile.

You can also leverage these bidirectional synchronization capabilities to ensure zero-downtime migrations when moving production applications to your unified profile. Once you’re confident the migration was a success, you can decommission the bidirectional synchronization and the legacy directory.

Figure 2: PingFederate enables federated SSO to all applications to facilitate consistent login and registration experiences, while Ping Directory exposes a unified profile to all apps and channels.

3.2

Lightning-fast Customer Interactions

We live in a world where instant gratification is the norm, creating zero tolerance for lag times and outages. A recent study by Google found that 53% of customers will abandon mobile websites if they take more than three seconds to load.³ Similar statistics exist for lags with other digital properties. Bottom line: if your apps are slow or your customers can’t login, they will shop elsewhere.

This is especially true during peak usage scenarios like Black Friday and Cyber Monday. These events present huge opportunities for retailers, but they’re also the most likely and the most costly time for lags and outages. An outage for a few minutes on peak shopping days could cost your organization much more than a longer outage on any other day.

Battle tested by the world’s largest retail enterprises and the most rigorous SLAs, the Ping Identity Platform leverages sophisticated, proprietary capabilities for massive scalability. It can efficiently replicate across wide area networks (WAN). While many systems will unnecessarily utilize bandwidth and chatty interactions between nodes, Ping is able to efficiently communicate and synchronize changes.

The Ping Identity Platform can monitor applications that are approaching maximum load to ensure that one application suffering a DOS attack or massive peak usage doesn’t take down other critical applications. It also reduces dependencies on spinning disks and solid state drives (SSDs) by storing identity data that needs to be readily accessible in RAM.

These capabilities and many more ensure that you’ll have plenty of scalability headroom to handle your most demanding SLAs, even during peak usage scenarios.

Figure 3: Ping has several proprietary secrets to scalability that enable it to handle some of the most demanding SLAs from global retailers.

Optimize Your Workforce and Supply Chain

Your employees and supply chain are the foundation on which your retail enterprise is built. Maximizing their efficiency is critical to your success.

You’ve already invested in applications and technologies that help employees work more efficiently and allow partners to provide their products and services to your customers. If accessing those technologies is too cumbersome or insecure, you may be putting that investment at risk. With high turnover rates in part-time and seasonal employees, and a lack of insight into partner employees, ensuring the right people have access to the resources they need can be difficult.

With the Ping Identity Platform, you can secure and manage access centrally, plus increase productivity by doing away with inefficient sign-on processes. You can enable partners to manage their own users, so you can stop managing partner identities and focus on managing partner relationships.

4.1

Secure and Efficient Employee Access

It’s critical that your employees are able to access the applications and technologies you provide. It not only makes their jobs easier, but it makes them more productive. Requiring employees to deal with complicated login processes and remember multiple passwords isn’t just inefficient, it’s fraught with security risk.

4.1.1

Simplify Employee Access

Your enterprise likely has numerous applications that employees need to access. These applications may range from simple interfaces for inbound phone calls to in-store technologies that enhance physical shopping experiences. Each of these applications may have different login protocols. Some may be hosted on-premises or in private clouds, while others may be SaaS apps.

A standards-based federated identity solution, like the Ping Identity Platform, allows single sign-on to be integrated into any application. Supporting standards like SAML, OAuth, OpenID Connect, WS-Fed, WS-Trust and more, it ensures your employees can easily access the applications they need with common login interfaces, a single set of credentials and familiar account recovery processes across all applications.

4.1.2

Secure Employee Access

Even with detailed policies and secure SSO, you can’t rely on passwords alone to protect your enterprise. If you do, you’re increasing your vulnerability to phishing scams, password reuse and brute force attacks.

Multi-factor authentication provides an additional level of security should employee credentials be compromised. When you use PingID as your cloud-based MFA solution, your users simply install the PingID app on their smartphone, register their device and then receive secure push notifications to approve authentications. They can approve login requests by simply entering a fingerprint, swiping up or receiving a one-time passcode by SMS or email. PingID also enables the use of hard tokens and other second factors. In any case, should a hacker get his hands on a user’s credentials, he can’t complete login without entering the second factor, which requires access to a recognized device that he won’t have.

To further streamline the process, the Ping Identity Platform provides adaptive authentication capabilities. This reduces friction by ensuring that MFA is presented only during risky scenarios. For example, if a user’s login context is consistent with normal daily use, a password alone can grant access. However, if the user is trying to access an application from outside a geofence around a store or office location, MFA would be required. Ping’s centrally managed policies can incorporate many risk variables around the user, their device, their environment or the resources they’re attempting to access.

Figure 4: Ping’s SSO and access security layers can reach out to PingID (in the PingOne cloud) to adaptively evaluate user contexts during authentication and authorization requests. In risky scenarios, MFA can be required to login or access certain applications.

4.2

Manage Partner Relationships, Not Identities

You likely have partners of varying sizes and technical capabilities. Some may have the ability to store their own employee identities, while others may not. Even if they do, they may not be able to connect their users to your applications. Often, you’re left with the burden of managing their users for them.

The Ping Identity Platform enables quick onboarding of partners and empowers them to self-manage their own identities, no matter their size or level of technical sophistication. For smaller partners without a directory, PingOne Directory provides a portal that allows partner employees to register. It saves their identity data in the cloud and enables controlled access to your enterprise applications through a branded dock.

For partners with their own directory, PingOne can connect to their Active Directory instance to authenticate users and enable SSO to your enterprise apps. Partners with their own federation or SSO solution can act as the identity provider and connect users to your apps using federated SSO through PingOne.

In all cases, partner identity onboarding, management and de-provisioning are left to the partner organization, removing the burden from your IT department and reducing the risk that a person no longer employed by a partner could have access to your applications and data.

Figure 5: Partners of all sizes can manage their own identities and give their employees access to your enterprise applications.

Transform Your Digital Business

As online-only retailers gain market share and technology continues to advance—including IoT—you must evolve or risk extinction. You’re challenged to embrace new engagement channels and ways of interacting with your customers, plus integrating these new technologies into complex, hybrid IT environments.

Your success in this dynamic retail landscape depends on your ability to support innovation in your organization. You must make it easy for new applications and technologies to access your unified customer profile so they can instantly recognize your customers and their preferences. You must also make it easy for employees and customers to securely login and access these new technologies. Doing so paves the way for you to become a digital business leader that your customers love and your competitors fear.

5.1

Manage Identities in Hybrid IT Environments

Retailers often prioritize moving to the cloud because it promises efficiency and cost savings. However, this can create security concerns and migration challenges for applications that aren’t cloud ready. While some apps may launch in the cloud or be easily migrated, many other high-value production applications will remain on-premises, making hybrid IT practically inevitable.

“Many large multichannel retailers are still nervous about cloud-based solutions due to data security concerns.”⁴

Not all vendors that provide identity solutions can deliver them in complex or hybrid IT environments. Many max out their capabilities at the SMB level. That’s why it’s important to involve your IT team early to make sure you choose a solution that will deliver the results you’re looking for in the environment you have. If you don’t, you may end up investing a lot of time, energy and money into a solution, only to find it doesn’t deliver the results you expect.

The Ping Identity Platform provides IAM capabilities that are uniquely suited to the disparate, hybrid IT environments common to large retailers. It empowers you to create a unified profile accessible to all applications on-premises or in the cloud and centrally manage secure and scalable identity services with a standards-based identity platform.

Figure 6: The Ping Identity Platform delivers common identity services at scale, even in disparate, hybrid IT environments. It can create a unified profile, common registration and login, and common identity services between apps hosted on-premises, in private clouds or in third-party SaaS environments.

5.2

Experience the Freedom to Innovate

To keep pace with innovation, new retail applications must be launched quickly and support personalized experiences. Often, rigid data schemas allow you to store only certain types of information about your customers. If an application needs to leverage information that isn’t already defined in a schema, it can be difficult and risky to perform schema migrations to store those attributes.

As a result, many applications end up either creating their own more flexible repository and not leveraging the unified customer profile or simply accepting that it isn’t reasonable to store certain attributes. These situations can lead to missed opportunities for personalization and slower time to market.

PingDirectory offers a schema-less architecture that can store semi-structured data, such as JSON, or unstructured data. This allows applications to store any type of information they need—geolocation, browser fingerprints or other app-specific data—without requiring database administrators to perform risky and time-consuming schema migrations. No longer hindered by rigid schemas, app developers can speed time to market, innovate and personalize their apps, while still utilizing a secure, scalable unified profile.

Figure 7: Apps can add app-specific data to a common unified profile without requiring risky schema migrations. This speeds time to market and gives app devs the freedom to create innovative, personalized experiences.

Protect Customer Data

Trust and customer loyalty go hand in hand. A data breach is the equivalent of a breach of customer trust, with the potential to drive customers to competitors, cost you hefty fines and create lasting brand damage.

“Seventy-five percent of consumers say they’re likely to switch brands if a company has a security breach that exposes their data.”⁵

Your IT team is on the hook to ensure that identity data is secure from the time your customers sign on to when their data is stored. With hackers and cyber criminals growing craftier by the day, you can’t take shortcuts when it comes to protecting your customers’ data and earning their trust.

Giving customers control over how their data is being used and who it is being shared with is also necessary to earn their trust. To do this effectively, you must be able to collect, store and enforce their consent preferences. This capability also helps you comply with privacy regulations, like the General Data Protection Regulation (GDPR).

6.1

Securing Customer Data

Since they often store sensitive personally identifiable information (PII), retailers have long been a target for hackers. Customers may initially trust you to secure their data, but a single breach can make them think twice about sharing their data with you and question doing business with you at all.

To truly secure customer data from end-to-end, you need to encrypt it in every state—in motion, at rest and during replication. You must also follow a laundry list of security best practices to prevent DDoS attacks, unauthorized admin accounts and other attack vectors.

Boasting a long list of security features to protect customer, employee and partner identities, the Ping Identity Platform meets the stringent security requirements of demanding global retailers. With Ping, you experience the benefits of:

Best practice password policies
Client connection policies
Limited-access admin accounts
Record-limited access
Tamper-evident logging
Criteria-based logging
Data obfuscation
Data layer encryption
Encrypted backup files, log files and change histories
Active and passive alerts
Resource limit policies to mitigate DoS
Simplified integration with third-party security monitoring tools

Figure 8: The Ping Identity Platform encrypts identity data in every state.

6.2

A Convenient and Secure Second Factor

Like employees, customers can have their credentials compromised in a number of ways that you have little control over. Multi-factor authentication is your best line of defense. But customers are especially sensitive to inconvenience, and some second factors add friction to the user experience.

Unlike employees, customers can’t be made to download a third-party MFA application. To gain adoption, you must use a medium they’re already comfortable with. This medium must strike the balance between security and convenience. As it turns out, you have such a medium in your mobile application. In fact, it’s an excellent candidate to act as a secure and convenient second factor.

The PingID SDK allows you to add secure MFA right into your own iOS or Android mobile app. Once deployed, your app creates a trusted device used to send push notifications to customers, giving them a convenient means of approving web and mobile web authentications, high-value transactions or mobile app authentications.

This approach is also more secure than other forms of MFA, including SMS and email, which can be easily spoofed or compromised by hackers. Push notifications can be customizable with information about specific transactions or authentication requests. Customers can easily approve or deny with a single tap or fingerprint. They can even self-manage their own devices.

With the PingID SDK, you can enable customers to approve e-commerce transactions over a certain dollar amount, verify their identities to CSRs, perform simple password resets and much more, all within your mobile app.

Figure 9: The PingID SDK turns your mobile app into a convenient and secure second factor.

6.3

PCI-DSS Compliance

Since retailers often store customer credit card data, you must ensure compliance with PCI-DSS guidelines. Given that many of these requirements center around customer identity, the Ping Identity Platform can play an integral role in ensuring that you are PCI-DSS compliant.

Figure 10: The Ping Identity Platform helps you comply with identity-related PCI-DSS requirements.

Conclusion

The proliferation of online retailers, new technologies and changing shopping behaviors are reshaping the retail landscape. With competitors only a click away, the battle for your customers’ loyalty is more fierce than ever. Without strategic investment in digital innovation, security, supply chain optimization and customer experience, you risk losing significant market share.

You must make it easy for your employees and partners to access the applications they need to provide the products, services and interactions your customers expect. And you must provide consistent, personalized experiences to customers no matter how or where they choose to interact with your brand. Getting these fundamental elements right will enable your enterprise to win the loyalty of your customers.

To retain this loyalty, you must earn trust. Just one breach of customer data can betray this confidence. Similarly, failure to give them control over how their data is being used will likely result in your customers shopping elsewhere.

Your customer loyalty, enterprise security, supply chain and digital innovation are all contingent upon identity. You have to know and recognize your employees and partners to give them the access they need. You must know and recognize your customers across channels to deliver the personalized experiences they expect.

The Ping Identity Platform empowers you to give the right people access to the right things. You’re able to easily integrate existing applications and quickly launch innovative new ones. You’re able to create a unified customer profile, so you can deliver bar-raising omni-channel customer experiences. And you can do it all at extreme scale, delivering lightning-fast interactions—even during peak usage—with the ultimate peace of mind that your enterprise and customer data is secure.

To learn more about how the Ping Identity Platform can help you create competitive advantage, visit www.pingidentity.com.

1 “State of the Connected Consumer,” Salesforce.com, Oct 24, 2016.

2 Merritt Maxim, with Stephanie Balaouras, Andras Cser, Salvatore Schiano and Peggy Dostie, “The Forrester Wave™: Customer Identity and Access Management, Q2 2017,” Forrester, June 15, 2017.

3 Alex Shellhammer, “The Need for Mobile Speed,” DoubleClick by Google, Sept 2016.

4 Joanne Joliet, Miriam Burt and Kelsie Marian, “Cool Vendors in Transforming Multichannel to Unified Retail Commerce, 2017,” Gartner, May 11, 2017.

5 “State of the Connected Consumer,” Salesforce.com, Oct 24, 2016.

6 Gina Pingitore, PhD, Vikram Rao, Kristen Cavallaro and Kruttika Dwivedi, “To Share or Not To Share,” Deloitte Insights, Sept 5, 2017.

#3319 | 04.18 | v03