When governments introduce new digital services, the focus naturally falls on making them simple to use. If people don’t adopt them, they can’t deliver the efficiency gains or improved public services they were designed for.
This is why the UK government has created a new advisory board on digital identity. As the Digital Access to Services Bill progresses, digital IDs are expected to become the way people access an increasing number of public services. The ambition is clear: make it easier to prove who you are online, reduce bureaucracy and create a more seamless experience for citizens.
It’s a sensible direction of travel, but it also raises an important security question. The more valuable a digital identity becomes, the more valuable it becomes to criminals.
We’ve already seen this shift play out across the private sector. Over the past few years, identity has become one of the most common routes into organisations. Rather than exploiting software vulnerabilities or trying to break through perimeter defences, attackers are increasingly finding ways to authenticate as legitimate users. Once they have access to a trusted identity, many traditional security controls become far less effective.
Recent attacks affecting organisations including Visa, Marks & Spencer, Jaguar and Harrods demonstrate the scale of the problem. Many involved sophisticated social engineering techniques designed to persuade employees to hand over credentials or approve authentication requests. Attackers understood that convincing a person to trust them could be easier than defeating the technology protecting the organisation.
That trend has important implications for digital identity. A physical passport or driving licence can certainly be stolen, but it generally provides access to one service at a time. A digital identity has the potential to unlock multiple government services, financial accounts and sensitive personal information through a single trusted credential. The convenience for citizens is obvious, but so is the incentive for organised cybercrime.
Success shouldn’t be measured solely by how many people adopt digital identities. It should also be measured by how well those identities withstand increasingly sophisticated attacks.
This is where Identity Access Management (IAM) has an important role to play.
For many organisations, IAM is still associated with usernames, passwords and multi-factor authentication. In reality, modern IAM is about establishing confidence that every person requesting access is who they claim to be, every time they interact with a service.
That starts with visibility. Organisations need a complete picture of identities across users, applications, cloud platforms and legacy systems. Without that visibility, it’s extremely difficult to detect suspicious activity or understand the impact of a compromised account.
Context is equally important. Logging in with the correct password should no longer be enough on its own. Modern IAM platforms evaluate a range of signals including device health, geographic location, login history and behavioural patterns before deciding whether access should be granted.
Imagine an employee who usually signs in from Manchester during office hours suddenly attempting to access sensitive systems from another country in the middle of the night. Even if the credentials are correct, that activity should trigger additional verification or block access until the user can be validated.
This approach, commonly referred to as risk-based authentication, allows organisations to strengthen security without creating unnecessary friction for legitimate users.
Behavioural analytics add another layer of protection by establishing what normal activity looks like for each identity. Rather than relying solely on known attack signatures, organisations can identify subtle changes in behaviour that may indicate an account has been compromised long before significant damage is done.
These capabilities matter because many modern attacks don’t begin with malware. They often begin with a phone call, an email or a convincing impersonation of an IT administrator.
Groups such as Scattered Spider have demonstrated just how effective these techniques can be. Attackers frequently contact employees pretending to be members of the IT team, persuade them to reset credentials or re-enrol authentication devices, and then use those legitimate credentials to access corporate systems.
Digital identity schemes need to be designed with this reality in mind. Technology will always play an essential role, but technology alone isn’t enough. Citizens need clear authentication processes that are difficult to imitate, straightforward guidance on recognising fraudulent requests and secure ways to recover access if an identity is compromised.
The advisory board therefore has an opportunity to do more than oversee the rollout of digital identities. It can help establish the security principles that will underpin public confidence in the system for years to come.
That includes encouraging phishing-resistant authentication methods such as FIDO2 passkeys, supporting continuous risk assessment rather than one-off authentication decisions, and recognising that identity compromise is something systems should be designed to detect and contain, not simply prevent.
Equally important is resilience. No security control is infallible, and digital identity should never become a single point of failure. Strong monitoring, rapid response processes and the ability to identify compromised identities quickly will be just as important as preventing attacks in the first place.
Digital identities have the potential to transform how citizens interact with the government. Faster access to services, fewer administrative barriers and stronger fraud prevention are all worthwhile objectives.
None of those benefits, however, will be realised without public confidence. The public needs to know that the systems protecting their identities have been designed with today’s threat landscape in mind, not the one that existed a decade ago. The cybercriminal groups targeting organisations today have shown that compromising identity is often more effective than attacking technology directly. There is every reason to expect they will apply the same tactics to digital identity as adoption grows.
The advisory board has an opportunity to ensure security is built into the programme from the outset rather than added in response to future incidents. If that happens, digital identity can become the secure foundation for modern public services that the government intends it to be. If it doesn’t, identity will become one of the UK’s most attractive targets for cybercriminals.
Dean Watson
Dean Watson is Lead Solutions Expert, Secure Networks at Infinigate UK&I. A trusted adviser in network infrastructure and security, he helps organisations upgrade, optimise and protect their company networks. With deep expertise in technology and industry trends, Dean provides specialist consultancy and practical guidance to businesses seeking secure, resilient and future-ready network environments.
