This is one of the 52 terms in The Language of Cybersecurity published by XML Press in 2018 and the contributor for this term is John Falkl.

What is it?

The process of ensuring that an action was taken by a specific person or entity. In IT security, non-repudiation is the ability to validate that the contents of a message received can be verified as unchanged and also verified as having come from a specific person or entity.

Why is it important?

When dealing with electronic transactions, it’s important to confirm with a high degree of certainty that actions or decisions were, in fact, taken by specific individuals or entities. Since hackers are getting better at impersonating identities, greater security measures must be implemented to ensure the integrity, accuracy, and authenticity of electronic transactions such as credit card purchases or digital signatures.

Why does a business professional need to know this?

Business professionals need to be able to verify that actions, such as bank transfers, contracts, and credit card purchases, can be linked with a specific actor (person or entity). Non-repudiation methods help ensure the following:

  • The action was not taken by a hacker impersonating someone.
  • The actor cannot claim to have not taken the action.

In today’s digital world, it is becoming increasingly important to verify that specific actions were taken by specific individuals. For transactions, such as financial transfers, that require greater integrity, organizations need to implement and enforce security measures that ensure the authenticity and intent of each transaction. For transactions, such as product surveys, where there is little or no business need to reliably identify a specific actor, it is less important to take such measures.

Measures to ensure non-repudiation include: notarization, multi-factor authentication, audit trails, digital signatures, and forensic analysis (e.g., handwriting analysis).

There are multiple technologies available to implement and enforce non-repudiation. Measures to authenticate identity play an important part in ensuring that individuals are, in fact, who they assert themselves to be. Digital certificates and encryption can secure a message and ensure that its contents are not altered during transmission.

In an expanding digital economy, the integrity of your business depends on your ability to prove that each critical transaction was verifiably executed by a specific, identifiable person or process.