Markus Hertlein, XignSys: “a lot of today’s IT solutions have difficulties combining security and simplicity”

As companies rush to develop new tech products to elevate our daily lives, more often than not, security seems to be the main focus.

Even though the use of digital identity became commonplace over the last few years, people still face some difficulties using or setting up this new technology. While it is important to secure mobile devices (for instance, with the use of a VPN) which are usually used to verify one’s identity, going through all the requirements and measures can sometimes feel like a hassle. Some users believe that secure authentication should just take a few clicks.

For this reason, to discuss authentication methods that are not only secure but also simple for the user, we invited Markus Hertlein, the CEO of XignSys – a company creating secure authentication solutions for smart cities. According to Markus, digital transformation is not possible if new technology is not user-friendly.

How did XignSys come about? What was your journey like since your start in 2016?

XignSys GmbH was founded in 2016 as a spin-off from the Institute for Internet Security at Westfälische Hochschule in Gelsenkirchen and thus has a strong background in IT security. Together with my partner and friend Pascal Manaras, I have always conducted research under Prof. Dr. Dipl. Ing. Norbert Pohlmann, the director of the institute. Together, we look back on more than 30 years of experience in IT security. The idea to start XignSys GmbH has been closely linked to proving that simplicity and security are not mutually exclusive in the digital world. On the one hand, we looked at the matter from a researcher’s perspective which gave us a clear, in-depth view about cybersecurity. On the other hand, we are also end-users: if we want to have a completely digitally connected world, then it must be secure, but at the same time effortless to use. This thought was essential as we created our unique way of authentication that makes passwords superfluous and secures the digital sovereignty of customers.

Today we are proud to remain loyal to the Ruhr area, have already grown to 30 employees, and won several well-known customers through all areas of businesses and smart cities.

Can you tell us about what you do? What are the main problems you help solve?

We are developing the smartphone-based, passwordless authentication solution XignIn, which is the key element for secure and user-friendly digitization. XignIn creates B2B value for companies and municipalities who would like to complete their smart city solutions and, of course, B2C value for citizens that benefit from direct integration of the trustworthy authentication solution in their daily more and more digitized world.

As I stated in the question before, one of the main problems is that a lot of today’s IT solutions have difficulties combining security and simplicity. Security, data protection, and user-friendliness should have top priority at the same time. We always put the user in the middle so that his or her data is kept secure and the user flows are simple. Everyone should be able to participate. Our focus is to create a fair and secure digital world for everyone.

Our journey has led us to develop our solutions for digital as well as real-world use cases and to sum it up we have the goal to create an easy, fast, and secure login for our everyday life in the smart city. After a one-time registration and merging of different identities, all kinds of services, both physical and digital, can be used.

Would you like to introduce us to your smart city concept? What are the cities going to look like in the near future?

In 2030, more than 70% of the population in Germany will live in cities. We need a digital transformation towards smart cities that can make the living space attractive and worth living for everyone! Secure and user-friendly digital identification and authentication of identities is a necessary basic element for the efficient use of networking systems and the broad application of the different smart services by users. With our solution, users can easily authenticate for applications in the smart city subsegments Smart Government, Smart Economy, Smart Mobility, Smart Education, Smart Health, as well as Smart Energy and Environment.

What challenges did the pandemic present in your field of work?

A major challenge we faced was especially in trying to reach our potential customers working in the eGovernment subsegment. Cities and their municipal offices still have other challenges to overcome in times of the pandemic than taking care of digitization in eGovernment use cases. They focus on topics like recording the Covid cases, organizing vaccinations, and mastering the allocation of hospital beds.

However, we are a young and dynamic company that is very flexible and is working in a digital world with a digital product portfolio. Even before the pandemic, our employees had the opportunity to work from their home office, and when the pandemic came, we shifted the entire business to the offices at home without reducing our productivity.

What technologies do you think will emerge in the near future as digital identity becomes an inseparable part of our lives?

Smart products and technologies will develop all over the smart city. There are small examples like smart coffee machines and of course bigger developments like entire houses and buildings whose energy efficiency is controlled via central measuring points (smart metering). One more example is the keyless access to public buildings or cars – so as you see, the entire city will gradually be digitized. There is not only a need for secure data storage but also for the comprehensive use of digital identities using our solution. In the near future, different public authorities and companies must be ready for the integration of digital identity solutions.

Do you think biometric authentication is going to surpass other authentication methods in the near future?

The use of biometrics can only be considered as one factor. In order to offer holistic, secure authentication, it is necessary to use several factors or a combination of them. With our XignIn technology, the authentication process is always the same: depending on the application and integration, users trigger the authentication process, for example, by scanning a QR code, pressing a mobile link, push, or another supported trigger. Important information is then transparently listed within the Xign.Me app as part of the data request. If users agree and confirm the request with their biometric feature, authentication takes place. The uniform, fast process, the intuitive handling, and, last but not least, the transparency of the personal data ensures a high level of acceptance, an increased sense of security, and the trust of the users.

In your opinion, what industries often turn a blind eye when it comes to Multi-Factor Authentication? Why do you think that is the case?

Many companies in Germany have not yet recognized the value of two-factor authentication. I think that especially subsegments like eEnergy and Environment, eEducation and eHealth, as well as municipalities have to focus on Multi-Factor Authentication. Hopefully, more specialist knowledge and expertise will be gathered in this area.

What actions can average individuals take to protect their identity from being used by threat actors?

I think that one of the most important factors is to use strong passwords everywhere. Always check the security and privacy settings of new devices and reset passwords or credentials immediately, do not leave the factory passwords. Try to use a second factor – often platforms offer its option. However, it would be important in the future to eliminate the password altogether because the use of passwords is a major security vulnerability. People should look into possibilities to log in more securely with new authentication solutions like XignIn.

Would you like to share what’s next for XignSys?

One important goal for us right now is to significantly advance digitization in Germany, especially in the area of eGovernment. In North Rhine-Westphalia, we can already report initial successes. We have currently concluded a very important agreement with the KDN (North Rhine-Westphalian organization of municipal IT service providers) based on the results of the “Smartphone Citizen ID” model project in Gelsenkirchen. With this agreement, we are offering KDN-members our easy to integrate, secure, and at the same time user-friendly solution for the digitization of administrations and as well for a wide range of applications in the smart city.

What’s coming up next? The contemporary connection with the Servicekonto.NRW, the one and only data portal for all eGovernment services in NRW where you are able to use one account for all online applications of the state and the municipalities. It enables citizens the secure, easy, and BSI-tested XignSys Login up to substantial (eIDAS) levels. All cities that would like to integrate our technology are soon able to use this connection to make safe data storage and usability even easier!

We are looking forward to seeing that other federal states will follow this example and help us establish our digital authentication standard throughout Germany and Europe. And as I said, the solution could also be used ideally for other smart city use cases. The added value: One login for all smart city applications. We are proud to be helping shape the smart cities of the future.