How Can Security Teams Detect Identity Squatting?

TL;DR

Identity squatting requires security professionals to distinguish deceptive impersonation from lawful name changes while deciding whether they are trusting the right person. Effective identity checks combine something a person holds, something they know, and something they are, while recognizing that identity laws, policies, and acceptable uses of alternative personas vary by circumstance.

Transcript

Thank you very much. Um, yeah, I can't compete with that. I'm not giving away a three-hundred and sixty degree camera. But we, uh, along with my, uh, co-author, um, Teresa Payton, we are doing book signings tomorrow for, uh, a couple of identity books that we, uh, that, that we have on, uh, it'll be in the bookstore at twelve thirty tomorrow. So, u... Read More

Key Insights

• Identity squatting is the act of presenting oneself as somebody else, but whether that conduct is permitted depends on changing laws, rules, and circumstances.
• Security professionals need identity assurance because they must know their customers, identify possible attackers, and verify teammates who may work remotely across the globe.
• Legitimate name changes are legally acceptable and may be protected, so security systems must record them correctly instead of automatically treating changed identities as deceptive.
• Identity verification is an old problem because historical governments, like modern organizations, needed to determine who was making claims and whether that person deserved trust.
• The Perkin Warbeck account shows how an impersonator can use detailed personal knowledge supplied by informed supporters to make a disputed identity claim appear credible.
• Possession-based verification works through something a claimant holds, such as a historically recognized sealed letter, a modern ATM card, or a letter of introduction.
• Knowledge-based verification works through information associated with the claimed identity, ranging from details about a royal household to a modern PIN or password.
• Inherence-based verification evaluates something a person is, including whether the claimant has the expected appearance, age, gait, or other recognizable physical characteristics.

Questions & Answers

Q: What is identity squatting in security?

Identity squatting involves claiming or adopting an identity other than the one by which a person is currently known. The security challenge is contextual because some attempts may conceal a person for apparently nefarious purposes, while other changes are lawful and acceptable. Professionals must determine whom they are dealing with, whether the presented identity is properly supported, and whether trust is warranted.

Q: Why should security professionals care about identity squatting?

Security professionals care because identity affects whom an organization can safely trust. They may need to know a customer to satisfy requirements in their field, identify an attacker attempting to enter a system, or verify teammates distributed around the globe. They must also locate concealed identities when necessary and accurately recognize people who have completed legitimate name changes.

Q: How can security teams distinguish impersonation from a legal name change?

Security teams should treat the circumstances and legal status of the identity change as central to the decision. A hidden identity associated with apparently nefarious conduct differs from a legitimate name change that is acceptable and protected under law. Internal systems therefore need a way to register lawful changes so the same person is correctly recognized under the new name.

Q: How does the Perkin Warbeck story illustrate identity squatting?

A young man appeared after Henry Tudor became king and claimed to be Richard of Shrewsbury, one of the missing princes from the Tower. He knew information the prince would have been expected to know, possibly because royal relatives in Europe had prepared him. After Henry subjected him to questioning, he claimed instead to be a young Dutch man named Perkin Warbeck.

Q: What does something you hold mean in identity verification?

Something you hold is an object or document used to support an identity or authorize a transaction. In the historical example, it could be a letter from a king or a letter bearing the recognized seal of an important person. Modern parallels mentioned in the talk include an ATM card and a letter of introduction, both presented as evidence connected to the claimant.

Q: What does something you know mean in identity verification?

Something you know is information that supports a claim of identity. Perkin Warbeck relied on details that Richard of Shrewsbury should have known, including aspects of the prince's earlier life, his time in the Tower, and information about the previous king or queen. Modern systems apply the same broad principle when they request a PIN or password.

Q: What does something you are mean in identity verification?

Something you are refers to personal characteristics that can be compared with what is expected of the claimed individual. Historical evaluators might consider whether a claimant looked right, had the appropriate age, or displayed a known physical trait such as a limp. Such evidence can support identity assessment, although the talk notes that historical investigators lacked DNA comparisons and useful fingerprints.

Q: Why is personal knowledge alone insufficient to prove identity?

Personal knowledge can be persuasive, but it may be learned from other people. The disputed prince claimant knew many details that Richard of Shrewsbury should have known, yet the talk suggests that relatives in Europe could have supplied this information because they wanted to regain power. Knowledge therefore supports a claim but does not necessarily establish that the claimant is the genuine person.

Summary & Key Takeaways

• Identity squatting matters because security professionals need to know their customers, attackers, and teammates, including colleagues they may never meet physically. They must uncover concealed identities when appropriate, but they also need systems that accurately register legitimate name changes protected by law and avoid treating every identity difference as suspicious.

• The account of Perkin Warbeck illustrates how identity impersonation predates modern technology. Claiming to be Richard of Shrewsbury, he reportedly used personal knowledge expected of the missing prince. Henry Tudor subjected him to questioning, after which he claimed to be a young Dutch man supported by relatives seeking to regain political power.

• Historical and modern identity verification use comparable categories of evidence. A recognized seal or royal letter resembles a card or letter of introduction. Knowledge of a prince's life resembles a PIN or password. Physical appearance, age, a limp, or other personal characteristics represent evidence based on something the claimant is.