►
Description
A virtual meetup hosted by Hyperledger Washington DC featuring Heather Dahl, CEO of the Indico.tech, which uses Hyperledger Indy for its Network, and Dr. Chase Cunningham, Chief Strategy Officer (CSO), Ericom Software, and one of the leading proponents of Zero Trust in the security community will explore how decentralized identity fits into the application of Zero Trust.
More details about the meetup are at: https://www.meetup.com/Hyperledger-Washington-DC/events/276120769/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerMeetups #Blockchain
C
B
B
D
D
So
just
I'm
going
to
be
the
professional
clicker
here
on
our
slide
deck
for
chase
and
myself,
but
just
to
level
set
about
what
we're
going
to
talk
today
is
our
theme
is
never
trust,
always
verify
and
chase,
and
I
actually
first
started
our
work
in
the
respective
areas
of
the
trust
of
the
verify
when
we
worked
together
at
nustar
developing
threat,
intelligence
solutions.
That
was
back
when,
like
eons
ago,
I
feel
chase-
and
this
is
where
our
paths
and
lives
have
taken
us.
D
But
we
have
always
worked
together
over
the
past
decade
on
how
can
we
make
the
internet
better
and
more
secure
for
everyone,
so
just
to
level
set
zero
trust
is
rooted
in
the
belief
that
nothing
should
be
trusted,
whether
it
resides
inside
the
network
or
outside
the
perimeter,
always
verify
decentralized
identity,
sometimes
known
as
self-sovereign
identity
is
a
consent
based
mechanism
for
using
a
blockchain,
enabled
verifiable
credentials
to
prove
things
about
who
you
are
without
anyone
else,
managing
storing
or
selling
your
data.
So
it's
privacy
and
proof
of
verification.
D
What
chase-
and
I
are
going
to
do
today
is
we're
going
to
kick
it
off
with
chase
we're
going
to
explore
how
decentralized
identity
fits
into
the
application
of
xero
trust
chase,
and
I
both
hear
when
I
talk
about
decentralized
identity.
I
get
questions
about
zero
trust
and
vice
versa,
so
we
thought
coming
together
to
doing
this.
To
do
this.
Meetup
would
actually
help
bring
both
models
together
under
one
umbrella
and
one
discussion
and
move
this
topic
forward.
A
Thanks
so
yeah
what
I'm
gonna
cover
and
I'll
be
moving
quick
here,
because
we've
only
got
an
hour,
but
I
think
we've
got
some
really
good
content,
so
I'm
going
to
talk
about
why
we
continue
to
fail
in
the
space
around
cyber.
I
want
to
point
out
again-
and
this
is
not
news-
anybody
the
perimeter
is
dead
like
it
died.
Coved
kobe
did
a
lot
of
bad
stuff.
The
only
good
thing
kova
did
was
it
effectively
eliminated
the
concept
of
a
secure
perimeter.
So
we
are
all
way
outside
of
that.
A
I'm
gonna
give
you
some
concepts
on
arguments
against
change
like
why
people
fight
this
talk
real
quick
about
why
zero
trust
is
what
it
is
why
the
cloud
is
so
important
and,
lastly,
I'll
leave
you
with
one
of
my
references,
which
is
the
mandalorian
right.
So
this
is
the
way
so
follow
with
me
here
and
we'll
be
moving
relatively
quickly.
A
Go
back
one
yep,
so
everyone
in
the
space
in
cyber
security
space
always
asks
about
the
next
attack.
The
next
attack.
What's
the
next
thing,
what's
post,
what's
going
on
space
based
and
future
state
malware
whatever
in
reality,
it's
the
same
thing
like
yes,
there
are
different
delivery
mechanisms
that
you
use
to
get
stuff
into
an
infrastructure
and
cause
compromise
like
solar
winds,
which
solarwinds
honestly
was
not
that
a
different.
A
It
was
basically
a
further
iteration
of
what
already
have
with
their
skin
norse
hydro
of
using
software
in
the
supply
chain
to
cause
an
exploit,
but
once
they
got
in
it's
the
same
thing,
that's
happened
a
thousand
times
over,
like
you
get
in
set
up
your
infrastructure,
move
laterally,
create
back
doors,
use
accounts,
privileges,
go
forward,
cause
bad,
you
know
things
and
problems.
It's
the
same
thing,
if
you,
if
you
think
about
it,
like
that,
we're
not
really
dealing
with
anything.
That's
that
crazy,
different.
A
Next
slide,
I
always
like
to
refer
everybody
to
the
office.
That's
one
of
my
favorite
shows
right
solarwinds
in
the
picture.
On
the
other
side,
if
corporate
asks
you
what's
the
difference
between
solarwinds
and
where
the
hack,
it's
not
it's
kind
of
the
same
thing
like
it's,
it's
basically
the
same
stuff,
just
slightly
packaged
different.
If
that's
the
case,
if
it's
always
sort
of
the
same
thing,
then
that
means
the
fundamental
physics
of
the
problem
are
being
ignored.
And
how
do
we
start
to
understand
that
and
address
with
it?
A
Next
slide,
bad
guys
continue
to
say,
they're
coming
back
like
this
is
from
the
guys
that
were
in
and
use
solar
winds
to
cause
compromises
and
said
flat
out
we're
coming
back
and
how
do
they
say
they're
coming
back?
Why
is
this
a
first
batch
for
them?
It's
because
they're,
preserving
access
and
they're
telling
you
flat
out
on
the
underground.
This
is
something
that
we
found
doing
some
recon
them
saying
we're
coming
back,
because
we
have
more
access.
How
do
they
have
more
access?
A
What
do
they
use
for
those
additional
accesses,
usernames
privileges
and
accounts-
again,
not
crazy,
different
after
they
get
in
this,
is
the
same
stuff
over
and
over
rinse
and
repeat
throughout
cyber
history.
If
this
continues
to
be
the
problem,
then
that
means
we're
ignoring
the
reality
of
the
space
in
which
we
operate
next
slide.
A
Andy
ellis
who's,
one
of
the
best
csos
in
the
business,
to
ask
the
question.
I
think
everybody
should
really
wrap
their
head
around
and
when
we
think
about
what's
going
on
in
the
space
in
the
future
state
of
where
we're
going
like
heather's
talking
about
the
future
of
this,
is
it
really
just
worried
about?
A
What's
going
on
right
now,
or
should
we
worry
about
what's
coming
in
the
future
and
if
it's
what's
coming
in
the
future
shouldn't
we
be
asking
this
question
of
what
else
is
going
to
be
continually
showing
up
in
the
news,
because
we're
ignoring
the
same
things
over
and
over
and
calling
it
something
new
like
this
is
a
really
good
question.
We
should
be
asking
what
are
the
fundamental
requirements
that
allow
this
to
continue
to
propagate
next
slide?
A
A
The
bad
guy,
just
like
the
good
guys,
needs
continued
access
to
continue
to
cause
compromises
like
I
showed
you
in
that
slide.
Prior,
that's
a
reality
like
that's
a
fundamental
flaw
in
their
operating
model.
If
you
look
at
the
kill
chain,
which
is
what
everyone
references
here
to
kind
of
ground
ourselves
in
the
space,
it's
these
things
refund
weaponized
delivery
exploit
install
command
and
control
exfiltration.
A
The
reality
is
we're
only
in
control
of
a
portion
of
that
and
the
bad
guys
on
the
rest,
if
you
click
you'll,
see
where
we
have
an
opportunity
to
disrupt
what
they're
doing,
we
can't
do
anything
about
recon.
They
look
outside
of
our
windows
and
walk
down
our
street
all
day.
Long!
That's
how
you
do
recon.
We
can't
stop
it.
The
internet
allows
recon,
we
can't
stop
weaponization,
they
will
find
stuff
to
use
to
cause
a
compromise,
a
la
solar
winds
and
all
a
hundred
other
things.
We
can't
stop
that.
A
We
can
stop
these
other
things
and
if
you
notice
we're
basically
saying
the
bad
guys,
you
got
to
we'll
give
you
two
out
of
these
seven,
we
own
the
other
five.
We
can
stop
delivery,
we
can
stop
exploitation,
we
can
stop
installation,
we
can
stop
command
and
control.
We
can
stop
exfil.
We
have
the
opportunity
to
disrupt
the
capability,
set
that
the
editor
uses
to
continually
access
and
cause
compromises.
It
requires
them
to
have
continual
access
which
is
based
on
what
users
identity,
access
passwords
those
types
of
things.
Next
slide.
A
They
have
to
have
access
for
success.
The
perimeter-based
model
categorically
has
failed.
If
you
build
me
a
50-foot
wall,
I
will
build
a
51-foot
ladder
like
it's
literally
that
simple-
and
this
has
proven
itself
time
and
time
again
throughout
history.
If
you
continue
to
engage
in
leveraging
perimeter
as
your
control
plane,
you
are
enabling
failure-
and
this
is
not
new
next
slide.
A
We've
known
about
this
for
about
a
thousand
years,
anybody
remember
the
story
of
troy
right.
Remember
we
used
to
call
malware
trojans.
Why
did
we
do
that
because
I
think
it
was
1260
bc
was
the
first
time
somebody
ever
slid
a
piece
of
infrastructure,
a
piece
of
malicious
code
past
the
wall
burn
things
to
the
ground.
I
mean
that's
exactly
what
happened?
We've
known
about
this
for
a
long
long
time?
A
A
It's
all
I
mean
in
reality
it's
about
being
security
better
for
the
users
better
for
how
we
operate
in
space.
What
we
don't
want
and
what
causes
problems
with
security
technology
is
we
continue
to
throw
them
into
the
mix
and
say
you
have
to
do
these
other
things.
You've
got
to
set
up
a
vpn.
You've
got
to
have
passwords.
Well,
you
have
to
reset
your
password
every
night
today,
oh
on
top
of
that
you've
got
to
do
mfao.
On
top,
you
need
to
make
sure
your
firewall
is
configured
correctly.
A
A
They
can
get
past
it
because
they'll
clip
that
piece
of
plastic
and
walk
back
in
and
they'll
leave
the
lock
bolted
for
you,
but
secure
perimeter,
just
like
we've
seen
10
000
times
over
is
not
a
referenceable
strategy,
because
what
do
we
use
to
invalidate
a
perimeter
access
if
a
user
can
get
past
something
we've
invalidated
a
perimeter
like
it's
that
simple.
So
that
means
that
we
must
put
the
perimeter
somewhere
else.
A
Another
thing
that
people
argue
about
in
the
space
is
they
talk
about
being
cyber
smart,
like
they're
gonna
make
their
people
better
at
stopping
compromises.
You
can't
do
that.
Four
to
six
percent
of
the
workforce
historically
is
going
to
click
a
link,
no
matter
what
you
do,
you
could
staple
their
hands
to
the
desk
and
people
would
use
their
nose
to
click
on
a
phishing
link.
Like
that's
the
reality
of
the
space
in
which
we
operate,
we
can't
make
people
that
aren't
cyber
people
cybersmart
all
the
time
every
time.
A
Just
to
give
you
an
example
of
how
crazy
it
is
to
try
and
think
will
make
people
better.
Seven
percent
of
americans
think
chocolate.
Milk
comes
from
brown
cows.
If
you
have
grown
adults
that
don't
understand
that
chocolate
milk
is
based
on
sugar
and
cocoa,
not
cows
that
are
brown.
You
think
you're
gonna
train
him
to
stop
a
fishing
exploit
like
that's
wrong.
We
can't
do
these
things
and
expect
the
outcome
to
be
any
different.
Next
slide.
A
Our
organizations
also
say
that
they
don't
have
enough
people,
they
don't
have
enough
people,
we
need
more
people,
we
need
more
people,
we
have
a
lack
of
human
capital,
that's
wrong.
We
have
enough
people
if
we
use
the
right
tools
to
solve
the
right
problems
in
the
right
ways.
Like
this
person
says
I
need
more
stuff.
I
need
more
they're
using
the
wrong
things.
A
You
see
that
they've
used
everything
that
they
could
to
take
that
lug
nut
off,
except
for
an
impact
wrench
I
mean
if
you
continue
to
use
the
wrong
tools
to
solve
the
wrong
problems.
Yes,
you
need
more
people.
If
you
use
the
right
tools,
an
impact
wrench
one
person
can
remove
all
six
of
those
lug
nuts
and
go
on
about
your
day.
A
The
cloud
does
not
make
you
inherently
more
secure.
We
can't
move
stuff
to
the
cloud
and
think
we're
doing
anything
any
better.
It's
just
the
cloud
is
someone
else's
infrastructure
and
jeff.
Bezos
is
glad
to
take
your
money
because
you're
putting
stuff
in
the
cloud.
This
is
from
aws's
terms
of
service
16
to
show
you
they
don't
care
whether
or
not
you're
secure
in
their
cloud.
It
says
their
security
requirement,
for
them
is
of
the
cloud
right,
compute,
network
storage.
A
You
are
responsible
for
stuff
in
the
cloud
and
they
don't
care
if
it
is
or
isn't
secure,
so
moving
stuff
to
the
cloud
fundamentally
categorically
strategically
does
not
make
things
any
better.
It's
just
you
saying,
because
it's
in
the
cloud
not
a
good
way
to
approach
the
problem.
Next
slide,
cyber
insurance
is
not
going
to
make
anyone
in
this
space
any
better
any
safer,
any
faster,
any
more
realistically
defended
than
it
was
in
the
past.
You
ever
wrecked
your
car
at
a
deal
insurance
company.
A
Imagine
if
you
wrecked
your
infrastructure
and
had
to
deal
with
an
insurance
company
paying
out
that
premium.
Anyone
that
says
that
they're
better
off
in
the
space
because
of
the
fundamental
issues
that
they
use
to
drive
a
decision
around
cyber
insurance
is
wrong.
They
should
be
sitting
like
ralph
wigan
on
the
back
of
the
bus
and
going
I'm
in
danger,
because
all
it
is
is
basically
saying
I've
paid
for
something
that
might
help
me
get
a
response
after
I've
been
breached.
A
Wouldn't
you
rather
deal
with
the
problem
before
it
becomes
a
problem
next
slide,
and
we
all
know
this
like
this
is
not
news
to
us.
The
problems
that
we
face
like
I
talked
about
back
with
solar
winds
and
everything
else,
we've
seen
10
000
times
before,
we've
been
warned,
and
it's
literally
this
clear.
If
you
hit
this
sign,
you're
gonna
hit
that
bridge
and
you
have
a
choice.
A
You
can
either
smash
the
gas
and
hope
you
bash
through
that
that
bridge
and
get
to
the
other
side,
and
maybe
your
vehicle
is
in
some
sort
of
state
where
it
can
continue
to
drive
forward,
or
you
can
say,
wait,
there's
a
different
way
to
do
this.
I
need
to
approach
the
problem
differently.
I
need
to
apply
strategy
and
technology
in
a
manner
that
addresses
the
realities
of
the
space
and
make
a
hard
right
turn
and
go
around
it
and
actually
fix
the
problem.
A
We
are
all
so
far
outside
of
the
perimeter
now
that
we
can't
continue
to
engage
in
thinking
that
the
old
space
is
going
to
work
any
better.
It's
not
you
can't
live
inside
of
the
horde
down
there
and
think
you're
not
going
to
get
bit
by
a
zombie.
It's
not
going
to
get
better.
2021
is
not
that
different
from
2020
everything
still
sucks.
I
mean
we're
still
here
on
zoom
we're
not
in
a
room
having
a
conversation.
A
A
That's
why
there's
a
movement
around
zero
trust
going
on?
That's
why
you
hear
it
so
often
it's
because
it
is
a
big
thing:
that's
taking
place,
because
people
see
the
value
in
it
and
they
understand
the
strategy
that
can
help
them
enable
outcomes
right.
78
of
organizations
globally
are
moving
towards
zero
trust
for
security
and
pressure.
A
Nine
percent
of
the
dod
13
of
financial
14
of
health
care,
the
total
addressable
market
for
zt
as
it
stands
right
now
today,
is
about
40
billion
dollars.
That
means
that
there
is
a
valid
verifiable
market.
That's
in
this
space,
the
tagline
which
heather
talked
about
earlier,
is
never
trust,
always
verify
pretty
simple.
The
definition
strategically
focused
on
addressing
lateral
threat
movement
within
the
network
by
leveraging
micro
segmentation
granting
enforcement
based
on
user
context,
data
access
controls,
location
application,
device
posture.
What
does
that
really
mean?
A
That
means
you
apply
very
vectored,
very
controlled
access,
controls
to
individuals
to
entities
within
space,
and
you
validate
and
verify
that
they
are
who
they
say
they
are
before
you
allow
a
connection
to
occur,
never
trusting,
always
verifying.
This
is
not
new.
This
has
been
around
for
about
12
13
years.
The
first
reference
you
can
find
of
this
is
all
the
way
back
in
2004
with
a
group
called
the
jericho
forum,
2010
john
kinderweg,
an
analyst
and
forester
before
me
talked
about
what
it
looked
like
and
how
zero
trust
was
strategically
focused,
etc.
A
A
There
are
three
very
basic
principles
here,
and
this
fits
very
well
with
digital
identities.
Blockchain
immutable
records
verify
explicitly
know
who
you
are
always
using
least
privileged
access
and
assuming
everything
is
compromised
until
you
prove
otherwise
you're
not
coming
to
my
house
right,
I
like
to
call
this
the
dating
my
daughter
slide.
I
don't
know
you,
therefore
you
will
not
get
near
my
daughter
period
point
blank
industry
until
later
on,
when
I
can
verify
that
this
is
okay.
Next
slide,
this
is
not
complicated.
If
it's
done
correctly,
this
is
how
simple
it
can
be.
A
A
Corp
is
just
google's
iteration
of
xero
trust,
and
if
you
look
at
what's
there,
what's
the
first
thing
you
see
identity
context,
then
a
rules
engine
then
enforcement.
The
first
thing
is
the
user,
knowing
who's
doing
what,
where
having
the
ability
to
control
that
access
that,
and
that's
that
particular
protocol
that
allows
that
to
occur
and
making
it
part
of
the
workflow,
because
it's
built
around
the
identity,
that's
what
we
have
to
focus
on.
That's
where
compromises
occur,
find
me
one
instance
of
a
machine.
That's
ever
been
hacked
where
no
human
touched.
A
It
doesn't
happen.
Next
slide.
It's
about
access!
It's
about
users,
people
on
devices
using
networks
to
get
to
resources.
You
have
a
policy
control
capability
in
there,
don't
call
it
zero
trust.
That's
fine!
Do
call
it
something
else,
but
the
reality
of
it
is
this
life
cycle.
This
chain
is
how
this
occurs
and
if
you
can
control
those
things
back
to
that
earlier
slide,
I
showed
you.
You
have
five
different
chances
to
disrupt
exploitation
operations
based
on
the
implementation
of
this
particular
approach.
It's
literally
that
simple!
A
You
can
break
it
down
and
go
even
further
into
it
right.
So
if
you
said,
what's
the
run
through,
that's
how
it
looks
an
fte
me
on
my
domain
join
device
at
home
on
my
isp
network
going
to
email,
an
o365,
nothing
is
weird,
I'm
logged
in
from
where
I
don't
log
in
this
time
of
day.
The
one
thing
that
I
do
to
have
an
out
of
band
authentication
is,
I
do
mfa,
like
that's
a
zero
trust
implementation.
A
You
could
add
other
things
into
that
about
the
people,
the
users,
the
control
space
and
whatever
continue
to
make
it
bigger,
better
faster,
but
ultimately,
this
is
what
that
life
cycle
looks
like
well.
Lastly,
I'll
leave.
You
like,
I
said
with
my
man
lawrence
like
because
this
is
the
this
is
my
favorite
part
of
it
is.
This
is
the
way
we've
tried
everything
else.
We've
failed
everywhere
else.
We've
realized
that
the
reality
of
the
problem
mandates
a
different
approach.
A
The
different
approach
is
a
combination
of
strategy
and
vector
technology
aligned
to
solve
the
realities
of
the
problem
for
the
space
in
which
we
operate.
Like
I
said
with
that
slide
earlier,
with
the
sign,
we
have
two
choices.
You
can
either
continue
to
go.
Really
really
fast
and
really
hard
and
you're
going
to
hit
the
bridge
and
bad
things
will
probably
happen
or
take
a
strategic
pause.
Look
at
how
we
really
deal
with
the
problems
and
make
a
hard
right
turn
regardless.
A
You
can
look
at
all
the
failure
in
the
past.
That's
what
it
is.
The
only
way
to
do
things
different
is
to
change
our
approach
going
forward
and
zero
trust
combined.
These
types
of
solutions
that
heather's
talking
about
is
the
way,
and
I
can
tell
you
flat
out
from
the
strategy
side
of
what
we're
doing
at
ericom.
We
will
be
plugging
into
and
we
will
be
using
these
types
of
things
for
validated
verifiable
credentials,
because
we
know
that
it
makes
a
heck
of
a
difference
there
and
I
run
a
node
like.
A
C
D
D
Well,
I
think
a
good
place
to
look
back
to
to
answer
that
question
is
how
do
you
verify
yourself
in
the
physical
world
and
why
do
we
think
that
verification
of
ourselves
offline
is
stronger
than
it
is
online?
And
that's
because
we
carry
around
things
like
driver's
licenses
passport
certificates,
neutralize
documents,
we
carry
them
in
our
wallets
our
purses.
We
keep
them
in
our
safety
deposit
boxes
and
we
present
them
at
very
high
value
transaction
transactions
like
buying
a
home
going
to
the
post
office
to
get
your
first
passport.
D
D
D
We
get
our
trustworthy
data
from
third
parties,
but
how
can
you
trust
and
verify
that
third
party,
ultimately
it
puts
us
into
this
world
of
complicated,
integrations?
I
think
covid
is
an
example
of
trying
to
share
data
between
one
industry
to
another
that
normally
doesn't
communicate
with
each
other.
How
do
you
provide
trust
in
these
interactions?
D
D
But
then
how
can
you
do
this
in
a
way
that
can
scale
and
it
prohibits
forgery?
So,
let's
take
a
just
a
tour
down
the
legacy
system.
We
all
know
about
the
centralized
database
approach
where
everyone
goes
into
one
single
domain
and
that
one
digital
authority
decides
to
pre
decides
to
be
the
issuer
of
your
identity
and
then
what
you
have
been
since
we
have
here
you're
everywhere
everywhere.
How
many
times
have
you
entered
the
same
information?
D
D
What
decentralized
identity
is?
Is
you
very
much
like
you
do
today?
Is
you
hold
the
proof
of
identity
with
yourself,
like
you,
do
with
your
wallet
and
you
can
choose
when
to
share
a
credential
with
a
verifier,
whether
that
be
a
school,
an
employer,
a
bank
a
shop?
So
they
can
ask
you
for
identity
to
prove
yourself
and
you
get
to
decide
whether
you're
going
to
share
a
credential
issued
by
another
entity,
and
you
can
also
share
what
portions
of
that
credential.
You
want
to
disclose
to
that
entity.
D
For
instance,
in
an
online
world
to
buy
alcoholic
beverages
through
a
wine
shop
online,
I
shouldn't
have
to
share
how
much
I
weigh
if
I
were
to
show
my
driver's
license
it.
Would
it
would
do
that
in
this
case
we
employ
zero
knowledge
proof
into
verifiable
credentials.
So
why
does
this
work?
Let's
break
this
down?
Why
does
this
work
in
our
analog
offline
lengths?
It's
because
we
have
trusted
issuers.
We've
decided.
D
D
The
state
of
maryland
department
of
motor
vehicles
don't
believe
they're
in
the
business
of
helping
people
buy
alcoholic
beverages
at
the
grocery
store
they're
in
the
business
of
giving
people
credentials
to
drive.
However,
the
trust
in
that
credential
is
why
the
system
works
in
our
analog
lives,
so
decentralized
identity
replicates
just
what
I
talked
about
and
it
brings
together
what
we
call
the
trust
triangle,
or
you
could
call
it
the
verification
triangle
where
you
have
trust
between
one
entity
and
another
on
the
issuance
of
the
credential.
D
The
credential
gets
issued
directly
from
the
issuer
to
the
holder,
which
can
be
a
person
a
thing
and
then
that
holder
decides
when
and
how
they
are
going
to
share
it.
With
the
verifier
in
this
system.
There's
a
governance
of
data.
It's
scalable,
it's
available
through
the
hyper
ledger:
open
source
repositories,
it's
developed
with
privacy
by
design.
It
also
has
built-in
compliance
by
design
for
those
who
are
implementing
it
and
also
allows
for
data
sharing
without
complicated
integrations.
D
So
here's
how
it's
broken
down.
You
have
the
philosophical
trust
that
we
have
today.
For
instance,
the
shop
trusts
a
credential,
that's
issued
by
a
bank,
but
that
trust
just
isn't
a
human
to
human
trust
that
trust
is
actually
built
into
the
technology
with
the
cryptographic
trust.
So
you
have
a
proof
of
identity,
a
proof
of
data,
and
then
you
have
a
valid.
D
You
have
a
presentation
of
validated
integrity
and
also
provenance.
So
what
is
a
verifiable
credential?
Exactly
we
hear
this
term
get
thrown
around
a
lot.
First
of
all,
it's
data,
that's
gathered
by
an
entity
that
has
been
granted
permission
by
the
person
that
the
data
is
being
given
to
and
they
have
permission
to
hold
it
on
it
verified.
D
Then
the
issuer,
in
this
case
packages
that
data
has
gone
through
their
own
kyc.
They
cryptographically
sign
and
link
this
to
the
issuer
as
the
original
source
of
the
credential,
then
that
credential
is
given
to
the
holder.
It
is
accepted
by
the
holder
and
is
now
controlled
by
the
holder
in
a
mobile
agent
or
digital
wallet.
D
So
what
you're
doing
is
you're
verifying
the
data
source
and
you're
doing
that
through,
in
this
case
hyperledger,
indeed
based
networks,
so
the
verifier.
Why
is
this
privacy?
The
verifier
can
actually
contact
the
issuer
and
verify
the
credential
based
on
the
network
without
a
direct
ping
or
what
we
call
phone
home
back
to
the
issuer.
So
I
can
verify
this
against
the
hyperledger
indie
blockchain,
but
I
am
not
going
directly
into
the
issuer's
database.
In
fact,
the
issuer
doesn't
even
know
that
the
verifier
has
verified
the
credential
here
using
the
network.
D
This
is
what
it
looks
like
when
you
break
it
all
down.
How
does
a
system
like
this
come
together
and
how
does
it
apply
to
hyper
ledger
you're
using
hyperledger
ursa,
which
is
the
cryptography
library
hyperledger
aries
that
that
is
the
project?
That's
focused
on
creating
agents
and
open
source
quotes.
So
in
this
case
you
need
cloud
agents,
mediator
agents
which
helps
talk
between
the
devices
and
the
issuer
and
laptops,
and
then
you
also
have
hyperledger
indy
and
indy
is
the
project
that
creates
the
networks
and
the
nodes
that
make
the
entire
system
run.
D
D
What
we
have
emerging
is
a
network
of
networks.
We
have
networks
that
have
come
about
over
the
course
of
the
past
year
and
a
half
for
different
purposes
and
reasons
what
these
networks
are
all
doing
is
working
together.
So
you
can
have
interoperability
where
you're
going
to
be
able
to
issue
a
credential
on
that
one.
Now
we
can
verify
it
on
another
network,
so
we
have
at
this
point
six
different
hyperledger
in
the
base.
Networks
and
dco
operates
a
network
that
is
a
professionally
run
network
with
a
mainnet,
demonet
and
test
net
sovereign
runs.
D
Also
a
public
permissioned
mainnet
builder
net
and
demonet.
Both
of
the
organizations
have
international
audiences
that
use
those
networks.
Id
union
has
come
out
of
germany,
it
is
also
a
volunteer
community
network.
We
also
have
fendi,
which
is
out
of
finland.
It's
a
consortium
of
finnish
organizations
that
have
come
together.
D
We
have
the
canadian
credential
network,
which
should
be
coming,
live
here
and
then
also
the
bedrock
business
utility
network,
which
will
be
another
professionally
run
network
and
that
one
is
also
pending
going
live.
But,
as
you
can
see,
these
networks
are
beginning
to
emerge
and
they
all
have
their
own
communities
involved.
D
D
D
We
offer
networks,
so
anyone
can
use
one
of
the
dco
networks
in
order
to
test
out
the
agents
in
the
ecosystem.
You
can
also
go
to
any
of
the
networks
that
I
showed
you
earlier
to
test
out
your
agents
in
the
case
of
indicio.
This
is
a
worldwide
effort.
This
is
not
washington
or
just
the
united
states.
We
have
nodes
on
every
continent
around.
We
have
nodes.
The
light.
D
Green
ones
are
those
that
are
in
the
process
of
being
stood
up,
but
what's
even
more
interesting
about
this
is
we
have
enterprises
and
communities
that
have
come
together
from
all
over
the
world
to
solve
the
same
problems,
especially
now
that
our
coveted
world
has
put
pressure
on
our
remote
work
life,
so
our
focus
on
in
dco
and
why
in
dco
and
why
we
spend
all
our
time
is.
We
are
focused
on
building.
D
A
You
know
stuff
that
shouldn't
cause
compromises.
This
is
this
is
the
way
to
actually
have
an
opportunity
to
remove
adversary,
access,
adversary,
control
and
take
back
some
of
that
initiative.
So
I
I've
been
a
big
fan
of
this
for
a
long
time.
Heather-
and
I
have
been
talking
about
this
for
like
she
was
saying
like
10
years
now,
which
is
terrible,
but
this
is
where
the
game
starts
to
change,
as
this
becomes
a
thing
for
organizations
to
adopt.
D
D
Do
the
technology
development
question
is
more,
should
I
should
I
trust
the
issuer
right,
and
so
that
is
something
where,
if
you're
a
verifier-
and
you
have
a
certain
level
of
information
that
you
need
or
it's
a
high
value
transaction,
you
are
probably
not
going
to
trust-
maybe
a
loyalty
card
issued
by
a
grocery
store,
because
there's
lower
value
trust
involved
in
that
credential.
In
this
case,
you
would
want
to
probably
you
know,
request
a
credential
that
was
given
by
a
bank
or
a
trusted
institution
that
has
a
department
of
motor
vehicles.
D
A
Somebody
asked
to
close
how
verified
creds
could
have
stopped
solarwinds.
So
let
me
clarify
that
stopping
an
exploit
is
pretty
much
a
non
non-issue.
I
mean,
like
I
said,
weaponization.
We
can't
really
stop
that.
However,
what
we
can
stop
is
the
continued
access
to
lateral
movement,
the
proliferation,
the
shared
resources
that
cause
those
and
that's
where
validated
verified
credentials.
A
Credentials
can
come
into
that
because
you're
able
to
apply
those
things
just
like
they're
talking
about
right
now
with
the
burn
down
list
that
microsoft
and
solarwinds
and
everybody
else
is
using
to
remove
access
to
remove
credentials
from
that
infrastructure.
So
you
know,
point
point
being
I
can
never
stop
an
exploit.
Like
I
even
said
during
my
slides
right,
recon
and
weaponization,
I
can't
stop
it
and
technology
by
its
very
nature,
means.
If
I
build
it,
someone
will
find
a
way
to
break
it.
D
We
have
a
question
about:
are
biometrics
considered
verifiable
credentials?
Yes,
biometrics
can
be
considered
verifiable
credentials.
There
are
a
number
of
projects,
specifically
around
biometrics
and
verifiable
credentials
going
on
in
the
space.
So
I
would
encourage
you
to
take
a
look
at
some
of
those
projects
to
see.
There's
some
really
interesting
things
that
they're
doing.
Also
that's.
Biometrics
is
being
used
as
a
way
of
offline
verification
as
well,
and
then
there's
a
question
about:
can
the
wallet
holding
the
credentials
get
stolen?
D
Another
one
that
I
get
is
what
if
I
drop
my
phone
in
the
pool,
what
happens
credentials
can
be
stored
in
digital
wallets
that
are
on
the
device
or
they
can
also
be
stored
in
digital
wallets
or
mobile
agents.
Cloud
agents
stored
in
the
cloud,
so
that
allows
the
backup.
So
if
your
wall,
if
your
phone
goes
into
the
pool
and
never
recovers,
you
still
have
the
ability
to
get
your
credentials
back.
There
is
a
white
paper
specifically
on
this.
I
I
that
actually
is
in
the
evernem
library.
D
D
D
Is
it
possible
to
decertify
an
issuer?
You
would
no
longer
trust
that
issue
or
you
would
no
longer
accept
the
credentials.
Someone
can
have
the
right
to
issue
credentials,
but
if
their
credentials
that
your
organization
does
not
trust
does
not
want
to
accept,
then
you
don't
have
to
accept
the
verification
of
it.
You
go
to
verify.
It
comes
from
an
issuer.
You
don't
trust
in
the
story.
You
don't
accept
it.
Is
there
a
process
and
appeals
process.
This
is
through
the
governance
that
you
would
have
and
what
credentials
you
accept
and
don't
accept.
D
If
so,
yes,
I
encourage
you
to
look
at
the
efforts
that
is
going
on
with
bc.
Gov.
Estonia
is
one
a
lot
of
really
forward-thinking,
pioneering
efforts
by
bc
gov.
That
is
the
area
a
lot
of
projects
going
on
in
canada,
finland,
because
they
are
running
the
fendi
network
and
we
also
see
some
countries
that
are
getting
ready
to
announce
digital
identity
based
on
verifiable
credentials
for
citizens,
also
in
the
next
probably
three
to
six
months,
and
a
lot
of
those
projects
are
focused
around
problems
that
have
been
created
by
covid.
D
What
I'll
do
is
talk
about
some
of
the
credentials
I'll
start
off
with
bc,
gov
and
bc.
Gov
is
doing
business
registrations
using
verifiable
credentials,
but
when
I
talked
about
the
closed
ecosystems,
what
we
are
doing
is
we're
seeing
organizations,
for
instance
the
the
most
obvious
one.
Is
your
coveted
health
status
where
an
organization
is
a
laboratory
or
health
provider
is
issuing
a
credential
that
gives
your
coveted
test
result.
D
D
Where
do
I
see
web
apps
using
decentralized
identity?
I
encourage
you
to
go
to
organizations
like
id
ramp
like
trinsic
like
evernem
like
cabin
or
their
liquid
avatar
application.
Global
id
is
moved
to
verifiable
credentials,
we'll
be
making
that
announcement.
So
there
are
a
number
of
organizations.
All
these
organizations
have
apps
and
wallets
that
you
can
use
and
download
in
your
daily
life
right
now.
A
I
can
tell
you
from
the
product
that
we're
launching
in
april
we're
looking
at
integrating
the
digital
id
side
of
the
verifiable
credential
into
that
whole
workflow,
so
that
we
have
customers
that
are
you
know
they
want
to
jump
in
and
not
have
to
do,
passwords
and
resets
and
all
the
other
crap
that
we
have
to
deal
with,
and
it's
just
you
know
you
have
a
validated
verified
set
of
credibles.
Do
we
do
we'll
control
the
infrastructure
stuff
and
go
on
about
your
day
like
removing
the
heft?
A
D
D
The
other
way
that
is
being
used
to
create
an
attribute
credential
like
a
coveted
vaccine,
is
using
existing
like
a
passport
and
doing
passport
scans
to
prove
who
you
are
with
a
biometric
check
against
who
you
are
and
then
issuing
a
credential
like
a
coveted
vaccine,
and
are
they
doing
this
using
single
and
multiple
wallets?
This
is
a
multiple
wallet
world.
It's
not
a
one
wallet
rules,
the
mall
type
of
situations.
D
B
D
D
No,
we
we
don't
care,
how
you
say
it
just
as
long
as
you
work
towards
its
decentralized
identity
and
and
that's
the
most
important
part
and
and
what
I
say
for
this
particular
meetup
and
is
for
chase,
and
I
this
has
been
a
decade-long
journey
for
both
of
us
and
to
be
here
today
talking
about
something
that
has
matured
significantly
between
zero
trust
and
decentralized
identity.
From
where
we
were
10
years
ago,
when
we
were
looking
at,
it
wasn't
even
called
threat
intelligence
solutions
at
the
time,
but
realizing
here's.
D
The
problem
with
these
compromises
and
breaches
that
we
were
working
on
trying
to
solve
is
it
all
came
down
to
decentralizing
and
identity
and
trust,
and
so
working
on
those
concepts
of
zero
trust
working
on
decentralized
identity.
While
it
may
seem
like
new
to
some
of
our
audience,
this
has
been
something
that
many
people
have
been
working
towards
for
over
10
years
now,.
C
Yeah,
just
a
quick
thing:
yeah
I
want
to
echo
jeff's
jeff's
comments
here.
I
want
to
thank
both
heather
and
chase
for
your
time
and
for
for
taking
this
opportunity
to
share
your
knowledge
with
with
their
members
and
a
lot
of
good
questions
came
up
and
a
lot
of
interactive
conversation
took
place
today.
So
thank
you
very
much.
C
We're
always
looking
for
interesting
topics
for
for
presentation
for
future
events.
So
if
any
one,
if
any
of
you
have
any
topics
or
know
of
someone
who
is
actively
engaged
in
that
space
and
working
on
some
cool
projects,
please
reach
out
to
either
me
or
jeff
or
both
of
us.
I've
left
our
contact
information
in
the
chat
room,
so
please
reach
out
to
us
separately.
So
that's
everything
I
have.
If
jeff
you
have,
if
you
don't
have
anything
else,
we
can.
I
think
we
go
and
wrap
it
up.
Yep.