In our second blog post of two on electronic signature security, we build on last week’s post that covered document, signature and transaction security.

Nathan Eddy wrote an interesting post for eWeek about CDW’s 2013 State of the Cloud Report. According to a survey of 1,242 IT professionals, cloud computing within organizations continues to rise as do the savings from the adoption these applications.

Respondents continue to cite security as a factor that needs to be addressed in cloud adoption. Security is always top of mind when moving signing processes online, particularly the security of the signature and the authentication of its user. While these are essential – and likely the first thing that comes to mind when contemplating electronic signature security – they only touch the surface of a successful, e-signing security strategy.

Our recommendations for implementing a secure and usable electronic signing solution fall into four categories, with the second two being:

USER IDENTITY, AUTHENTICATION AND ATTRIBUTION

Personal information verification (PIV) can be accomplished through self-identification (the customer enters personal information about themselves such as the last few digits of their social security number) or third-party identification (when that information is verified against a third party verification service such as Equifax). The latter is frequently used by financial service providers, who are already accessing credit databases as part of the underwriting process.

Once an individual’s identity is established, an organization may choose to issue electronic credentials to facilitate future electronic transactions. The most widely accepted standard for user authentication in online transactions has traditionally been user name and password. When combined with email notification, challenge/response and knowledge-based authentication, you have a usable, reliable and cost-effective way to identify people.

To establish attribution, a one-time, unique password sent via text message is a popular option. This links the customer to the transaction and provides an audit trail that becomes part of their electronic signature.

DATA AND SYSTEM SECURITY

Today’s e-signature solutions are available in a number deployment options including on-premises, on the cloud as a managed service, or as a software-as-a-service (SaaS). Regardless of where the application is hosted, the solution must meet regulatory, industry and corporate data and system security standards and have dozens of physical and logical access controls, including but not limited to:

• Device management and access (mobile and fixed)
• Data encryption
• Internal security, identity management & authorization
• Data storage
• Perimeter security
• Physical security
• Intrusion detection

For more information about security when adopting an electronic signature solution for your business, download a white paper on electronic signature security.

The post 360 Degree Electronic Signature Security – Part 2 appeared first on Blog.