Difference between revisions of "Assurance"

Revision as of 06:29, 8 August 2018

Full Title or Meme

The level of trust that can be afforded a claim of an Identifier or Attribute.

Context

• Some means for assuring the Web Site Security is required. See that page for details.
• The rest of this page is about establishing a level of assurance for Personal Information about a User also known as a Subject.
• NIST 800-63-3

Problems

• In contexts where names are not validated (of low Assurance) the problem arises that trolls many adopt the name of some well-known person to be able to make statements that falsely appear to be from the real person.^[1]

Solutions

A rather facile mapping of the NIST levels of Assurance to the processes known today is:

• AAL1 ==> password
• AAL2 ==> 2FA
• AAL3 ==> U2F

The best source of Truth about an Identity is obtained by documentation of the Identity Proofing process.

References

1. Synonyms include: Validated.
2. ↑ Jack Nicas, Oprah, Is That You? Most Likely, It's Not. 2018-07-08 New York Times page BU1