Equifax in Joint Venture To Shore Up Web Security

Equifax Secure Inc. has bolstered its Internet security services offering through an agreement with Sun-Netscape Alliance.

Bringing together some of the most prominent vendors in the electronic commerce field, the affiliation is intended to address concerns that may make banks and corporations hesitant to adopt digital certificate techniques.

Though widely viewed as the best method for authenticating identities of unseen parties on the World Wide Web, digital certificates can be complex, incompatible across different types of software, and difficult to administer.

Sun-Netscape Alliance, a byproduct of Netscape Communications Corp.'s recent merger with America Online Inc., said Tuesday that it will add Equifax Secure's patent-pending authentication process to its e-commerce service portfolio. This on-line capability, drawing on the data base expertise of Equifax Secure's parent, Equifax Inc., would be licensed to customers of Sun Microsystems Inc. and Netscape.

The affiliation also would let Equifax Secure sell outsourcing services using technology from Netscape that will broaden its own certificate authority, or CA, offering.

In assembling its outsourcing service, which is designed to simplify digital certification for banks and other companies, Equifax Secure has formed a string of technology alliances. One, with International Business Machines Corp., for example, dates to June 1998, making available IBM's Vault product line for digital certificate and directory services.

"What we are trying to do, through these relationships, is make the technology deployment much smoother for the ultimate client," said Jeffrey R. Johnson, senior vice president and general manager of Equifax Secure.

Working with the Equifax unit "dramatically expands our distribution channel," said Frank Chen, director of product development at Netscape, the Internet browser leader that has been heavily focused on on-line commerce systems.

Internet merchants desire more assurance about the clients they are dealing with, which makes Equifax's authentication approach attractive, Mr. Chen said.

The target audience will be any bank or other entity interested in issuing and managing digital certificates for a variety of wholesale and retail interactions.

Mr. Chen said thousands of corporate and merchant customers use Sun- Netscape products, primarily those of "global 2000" size.

Cooperating with Sun-Netscape and others, Equifax Secure is in a position to promote digital certificates and public key infrastructures for data encryption, Mr. Johnson said. For that reason, "we are very careful to pick partners we think are leading-edge people."

Equifax can help to contribute a level of trust that few in the Internet security business can match, said Phil Schacter, director of Burton Group, a Midvale, Utah-based consulting firm to Fortune 500 companies.

Equifax maintains credit information on 200 million consumers in the United States and 300 million globally. The Atlanta company, which celebrated its centennial on March 22, was formed to sell consumer payment information to merchants for use in evaluating individual creditworthiness. The credit bureau has evolved into one of the most powerful data base operations in the world.

"The baton is being passed to more traditional trust providers, who are recognizing this as a service that they can effectively offer," Mr. Schacter said. He added that companies such as Equifax "already have the trust of the market" and can build on that. "Trust is more than just holding on to a digital certificate; it has to do with the policies of the guy who validated it and gave it to you in the first place."

Andrew W. Jeffrey, an analyst at BancBoston Robertson Stephens who recently initiated coverage of Equifax with a "buy" rating, said Equifax Secure could become a major source of revenue growth for the parent company. Equifax's revenues in the first quarter rose 19%, to $421.5 million.

"The market for business-to-business electronic commerce could be several billion dollars in the next few years," he said. "I think Equifax's partnership with IBM is very bullish. It gives them-particularly on the business-to-business side-the ability to integrate authentication and digital certificate technology into IBM's hardware."

He said Equifax Secure takes competitive aim at Verisign Inc., a Silicon Valley certification pioneer that gained "a clear 'first-to-market advantage." But the analyst said that lacking Equifax's data assets, "it will be real tough for Verisign to compete."

Equifax Secure would assure the identity of people during the digital certificate issuing process, asking for specific information on-line that only an individual applying for a digital certificate could know.

"We compare the answers to the information in our data bases, and, based on how well they match, a determination is made whether it is really you or not," Mr. Johnson said.

Wholesale customers could determine their own comfort levels with a given electronic credential, which is somewhat similar to Verisign's various levels of assurance for its digital certificates.

"The bank or corporation can ratchet the assurance levels higher or lower by asking more questions or taking more time," Mr. Johnson said. "It's a trade-off to find that right balance in terms of consumer inconvenience and how long it takes."

Equifax Secure's authentication customers include Security First Network Bank, the Internet pioneer that is now a part of Royal Bank of Canada, and the on-line auctioneer eBay Inc.

The authentication software would be commercially available with Netscape Certificate Management System 4.0 in the second half of 1999. Various Netscape products combine to form its Directory for Secure E- Commerce, which can support 50 million users and 5,000 queries per second.

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER