How Digital Identity Drives Innovation and Security for Retailers

If you’ve seen the movie Finding Nemo, you remember Dory, the blue tang fish with short term amnesia, who can’t remember anything for more than a few seconds. Each time one of the characters interacts with her, she asks questions that were already answered and forgets vital information that is relevant to the conversation.

Unfortunately, many applications from large retailers behave this way. Even though a customer just logged in, set preferences or updated personal information in one app, another app from the same retailer has no idea about the previous interaction. Not only does this present missed opportunities for personalization, but the customer may also be inconvenienced with additional login requirements or have an order shipped to an old address.

Creating a unified profile requires much more than surface-level communication between applications, which is typically the extent of the “unified profile” promised by marketing vendors. A truly unified profile is like the cure for Dory’s amnesia. It enables your mobile apps, websites, CSRs and other channels to see the same customer record. It enables consistent sign-on and registration experiences. With a unified profile, all applications and channels can instantly recognize customers and their preferences. This gives customers the contiguous experience of interacting with a cohesive brand, instead of disparate applications.

The concept is simple, but creating a unified profile in today’s retail enterprise environments is anything but easy. The Ping Identity Platform is an enterprise customer IAM solution that enables you to create a unified profile from authentication to the data layer, even in complex or hybrid IT environments.

We live in a world where instant gratification is the norm, creating zero tolerance for lag times and outages. A recent study by Google found that 53% of customers will abandon mobile websites if they take more than three seconds to load.³ Similar statistics exist for lags with other digital properties. Bottom line: if your apps are slow or your customers can’t login, they will shop elsewhere.

This is especially true during peak usage scenarios like Black Friday and Cyber Monday. These events present huge opportunities for retailers, but they’re also the most likely and the most costly time for lags and outages. An outage for a few minutes on peak shopping days could cost your organization much more than a longer outage on any other day.

Battle tested by the world’s largest retail enterprises and the most rigorous SLAs, the Ping Identity Platform leverages sophisticated, proprietary capabilities for massive scalability. It can efficiently replicate across wide area networks (WAN). While many systems will unnecessarily utilize bandwidth and chatty interactions between nodes, Ping is able to efficiently communicate and synchronize changes.

The Ping Identity Platform can monitor applications that are approaching maximum load to ensure that one application suffering a DOS attack or massive peak usage doesn’t take down other critical applications. It also reduces dependencies on spinning disks and solid state drives (SSDs) by storing identity data that needs to be readily accessible in RAM.

These capabilities and many more ensure that you’ll have plenty of scalability headroom to handle your most demanding SLAs, even during peak usage scenarios.
 

Figure 3: Ping has several proprietary secrets to scalability that enable it to handle some of the most demanding SLAs from global retailers.

It’s critical that your employees are able to access the applications and technologies you provide. It not only makes their jobs easier, but it makes them more productive. Requiring employees to deal with complicated login processes and remember multiple passwords isn’t just inefficient, it’s fraught with security risk.

You likely have partners of varying sizes and technical capabilities. Some may have the ability to store their own employee identities, while others may not. Even if they do, they may not be able to connect their users to your applications. Often, you’re left with the burden of managing their users for them.

The Ping Identity Platform enables quick onboarding of partners and empowers them to self-manage their own identities, no matter their size or level of technical sophistication. For smaller partners without a directory, PingOne Directory provides a portal that allows partner employees to register. It saves their identity data in the cloud and enables controlled access to your enterprise applications through a branded dock.

For partners with their own directory, PingOne can connect to their Active Directory instance to authenticate users and enable SSO to your enterprise apps. Partners with their own federation or SSO solution can act as the identity provider and connect users to your apps using federated SSO through PingOne.

In all cases, partner identity onboarding, management and de-provisioning are left to the partner organization, removing the burden from your IT department and reducing the risk that a person no longer employed by a partner could have access to your applications and data.
 

Figure 5: Partners of all sizes can manage their own identities and give their employees access to your enterprise applications.

Retailers often prioritize moving to the cloud because it promises efficiency and cost savings. However, this can create security concerns and migration challenges for applications that aren’t cloud ready. While some apps may launch in the cloud or be easily migrated, many other high-value production applications will remain on-premises, making hybrid IT practically inevitable.

Not all vendors that provide identity solutions can deliver them in complex or hybrid IT environments. Many max out their capabilities at the SMB level. That’s why it’s important to involve your IT team early to make sure you choose a solution that will deliver the results you’re looking for in the environment you have. If you don’t, you may end up investing a lot of time, energy and money into a solution, only to find it doesn’t deliver the results you expect.

The Ping Identity Platform provides IAM capabilities that are uniquely suited to the disparate, hybrid IT environments common to large retailers. It empowers you to create a unified profile accessible to all applications on-premises or in the cloud and centrally manage secure and scalable identity services with a standards-based identity platform.
 

Figure 6: The Ping Identity Platform delivers common identity services at scale, even in disparate, hybrid IT environments. It can create a unified profile, common registration and login, and common identity services between apps hosted on-premises, in private clouds or in third-party SaaS environments.

To keep pace with innovation, new retail applications must be launched quickly and support personalized experiences. Often, rigid data schemas allow you to store only certain types of information about your customers. If an application needs to leverage information that isn’t already defined in a schema, it can be difficult and risky to perform schema migrations to store those attributes.

As a result, many applications end up either creating their own more flexible repository and not leveraging the unified customer profile or simply accepting that it isn’t reasonable to store certain attributes. These situations can lead to missed opportunities for personalization and slower time to market.

PingDirectory offers a schema-less architecture that can store semi-structured data, such as JSON, or unstructured data. This allows applications to store any type of information they need—geolocation, browser fingerprints or other app-specific data—without requiring database administrators to perform risky and time-consuming schema migrations. No longer hindered by rigid schemas, app developers can speed time to market, innovate and personalize their apps, while still utilizing a secure, scalable unified profile.
 

Figure 7: Apps can add app-specific data to a common unified profile without requiring risky schema migrations. This speeds time to market and gives app devs the freedom to create innovative, personalized experiences.

Since they often store sensitive personally identifiable information (PII), retailers have long been a target for hackers. Customers may initially trust you to secure their data, but a single breach can make them think twice about sharing their data with you and question doing business with you at all.

To truly secure customer data from end-to-end, you need to encrypt it in every state—in motion, at rest and during replication. You must also follow a laundry list of security best practices to prevent DDoS attacks, unauthorized admin accounts and other attack vectors.

Boasting a long list of security features to protect customer, employee and partner identities, the Ping Identity Platform meets the stringent security requirements of demanding global retailers. With Ping, you experience the benefits of: 

• Best practice password policies
• Client connection policies
• Limited-access admin accounts
• Record-limited access
• Tamper-evident logging
• Criteria-based logging
• Data obfuscation
• Data layer encryption
• Encrypted backup files, log files and change histories
• Active and passive alerts
• Resource limit policies to mitigate DoS
• Simplified integration with third-party security monitoring tools
   

Figure 8: The Ping Identity Platform encrypts identity data in every state.

Like employees, customers can have their credentials compromised in a number of ways that you have little control over. Multi-factor authentication is your best line of defense. But customers are especially sensitive to inconvenience, and some second factors add friction to the user experience.

Unlike employees, customers can’t be made to download a third-party MFA application. To gain adoption, you must use a medium they’re already comfortable with. This medium must strike the balance between security and convenience. As it turns out, you have such a medium in your mobile application. In fact, it’s an excellent candidate to act as a secure and convenient second factor.

The PingID SDK allows you to add secure MFA right into your own iOS or Android mobile app. Once deployed, your app creates a trusted device used to send push notifications to customers, giving them a convenient means of approving web and mobile web authentications, high-value transactions or mobile app authentications.

This approach is also more secure than other forms of MFA, including SMS and email, which can be easily spoofed or compromised by hackers. Push notifications can be customizable with information about specific transactions or authentication requests. Customers can easily approve or deny with a single tap or fingerprint. They can even self-manage their own devices.

With the PingID SDK, you can enable customers to approve e-commerce transactions over a certain dollar amount, verify their identities to CSRs, perform simple password resets and much more, all within your mobile app.
 

Figure 9: The PingID SDK turns your mobile app into a convenient and secure second factor.

Since retailers often store customer credit card data, you must ensure compliance with PCI-DSS guidelines. Given that many of these requirements center around customer identity, the Ping Identity Platform can play an integral role in ensuring that you are PCI-DSS compliant.

Figure 10: The Ping Identity Platform helps you comply with identity-related PCI-DSS requirements.

Regulations, like GDPR, require retailers who store EU citizen data to give customers control over and insight into how their data is being used and shared. Violations can be met with fines in the billions. Regulations aside, your customers still expect you to respect their privacy by enforcing opt-out wishes and not sharing data with partners and others that they haven’t authorized.

The Ping Identity Platform gives you fine grain control over how customer data is shared. Able to consider customer consents or other data stored in the unified profile, it can restrict entire profiles or even individual attributes from applications that don’t need them or ones that customers haven’t agreed to share data with.