Unlocking the Power of Digital Signature Legality for Life Sciences in Canada

How to eSign a document: digital signature legality for Life Sciences in Canada

hello everyone and welcome to the digital signatures webinar presented by global sign I'm Chris algeri with the global sign marketing team and I want to thank you for joining us today at this time I would like to introduce Sid Desai Sid is the head sales engineer at Global sign he's responsible for implementing Advanced epki solutions for our customers he's an IT expert with a strong passion for sales and Consulting uh he really understands the technicality of these applications and can translate them into everyday terms so please feel free to send in any questions for Sid so now I'll hand it off to you Sid all right um thank you Chris for the introduction um now that we' have covered all the logistics let's go ahead and jump into the material today so today we'll be start we'll start off with the introduction to digital signatures and why you need them we'll go into defining and explaining the raw guts of a digital signature share with you how digital signatures work cover some of the solutions out there in the market Marketplace today and wrap up with how to find the ideal signing solution for you so digital signatures are quickly becoming a trending topic across different private public and government organizations um no matter how big small or large your um organization is the interest in digital signatures is pretty strong these days and I think mostly due to the fact that people want to automate their resource heavy paper based signing processes ing to an industry study recently published by Gartner the overall market for electronic signature software and services grew by 48% from 2010 to 2011 with similar growth expected in 2012 and Beyond about 3% of contracts today are signed digitally but in the next three or four years the number is of course expected to increase by up to 50% the emerg of cloud based and software as a service based models has lowered the barriers to Market entry and this has resulted in a rapid influx of new competition in the market in 2009 only about 5% of electronic signature activity was sof as a service based projections show that figure uh should go up to about 50% in 2014 the truth is that the digital signature Market has seen increased adoption rates over the last few years um notably the the usage by life insurance companies has increased from 47% in 2007 to 74% in 2013 even the US Army to has deployed an eature solution for over their 1 million Personnel so from a legal perspective there are legislations such as UA which is the uniform electronic transactions Act and the esign act that have helped standardize and facilitate the use of digital signatures in place of paper based signatures many Industries have based their acceptance of digital signatures on the guidelines put forth in these two acts just just to give you an example the FDIC and the United States Securities and Exchange Commission which is the SEC have issued standards for the use of digital signatures in the financial sector and then there is the title 21 CFR part 11 that dictates the use of electronic records and signatures for the FDA the these code of federal regulations or cfrs um as some people call them vary state by state for example each States professional engineering board dictates the acceptance of digital signatures for the architecture engineering and construction sector um as far as cost savings go digital signatures lead to reduce paper and transportation costs increase return on investment from shortening the actual signing transaction times and on top of everything else provide increased security around recordkeeping recent industry success stories cite millions of dollars being saved in administrative paper related processes 75% reduction in error rates and 85% reduction in shipping costs in addition to mailing and transportation savings there are savings associated with the elimination of manual processes um such as mail sorting Document Handling scanning Etc these typically result in 70 to 80% improved efficiencies and error reduction where more than 50% of the paper signatures required rework due to income complete forms and so on in a study on benefits of e signatures omed research came up with the following numbers with the use of additional signatures it cost $20 less per document compared to paper based signatures so as you can see the cost benefits are plenty um then of course there are other soft benefits associated with the overall improved customer experience reduced cycle times improved compliance an environmental impact just to name a few some institutions have experienced cycle times reduced from weeks to days or from days to hours have their shipping costs savings up by up to 80% and error rates reduced to less than 5% and all these Investments have paid off in less than two years so before we get into the types of digital signing Solutions let's get a quick overview on what digital signatures are firstly you have to understand that not all electronic signatures are digital signatures electronic signatur is a broad term used to refer to any type of digitized version of a physical signature and can be as simple as a scanned image of a handwritten signature they may or may not be verified by a third party and often almost do not contain any security measures to prevent changes to the document digital signatures are a more secure type of electronic signature and are based on public key infrastructure that's pki when someone receives the digitally signed document he or she knows where the document came from via the identity of the signer when it was signed thanks to a thirdparty Tim stamp that is applied at the time of signing and that the content of the document has not been altered since the signature was last applied there are cryptography operations apply to the document that helps keep it entirely secure we'll look at how this works in a couple of slides so at the root of it digital signatures are made up of two key Parts a digital certificate and the data being signed additional certificate is kind of a virtual passport a thirdparty verification entity called a certificate Authority verifies your identity and issues you a certificate since the certificate is unique to you using it to sign a document is a way for you to prove yes it's really me signing this document when you apply a digital signature a cryptographic operation binds your digital certificate and the data being signed for example a PDF or any other document into one unique fingerprint the uniqueness of these two components of a signature the signer's identity and the data are what makes digal signatures a viable replacement to wet ink signatures and because signature is unique to the signer and the third party validated certificate was used to apply the signature the recipients now know that it was actually you who signed it which satisfies the authentication component of a digital signature and since it was your certificate that was used to sign the document you cannot later claim that it wasn't you who signed it which makes your signature completely non-repudiable and legally binding finally because the signature is unique to the docum when the signature is verified it checks that the data in the document matches what was in there when the signature was applied even the slightest change to the original document would cause this check to fail this keeps the message Integrity intact for those of you who haven't seen what additional signature looks like this is what it is in a in a PDF um Adobe PDF file and a Microsoft Word document so when you look at a typical workflow for digital signatures you first create the document with whatever Enterprise tools you have available the typical Microsoft Word Adobe PDF Microsoft Excel Etc are the ones most commonly used to create documents you then simply distally sign the document by using some of the built-in options available in these tools or you can leverage a plugin which could be a thirdparty developed software that uses your locally or centrally stored digal certificate to finish the workflow you send the disly signed document via email or any other workflow automation tools that your company uses so earlier we talked about a cryptography operation that takes place every time you use a digital signature these two images in my opinion summarizes the process pretty well if you look at what happens behind the scenes during the signing process a hash function of the data that you want digitally signed is encrypted using the signers signers private key and along with the dist certificate is attached to the data together The Binding of this certificate with additionally signed hash comprises of additionally signed document or data on the verification end where the recipient of the document receives your file the data and the signature are then separated after some recipient inside hashing and decrypting the hashes are compared if the hashes are equal then the signature is valid any mismatch in the hashes that could have resulted in some tampering with the data results in an invalid signature so as you can see there's built-in tamper prevention with digital signatures so now that you know what happens behind the scenes when you're signing document digitally let's take a look at what you need and where you should start to begin digitally signed documents you need two things at a minimum one a digital certificate and two a digital document a digital certificate ties the identity of a specific person organization or Department to what is known as a public key this public key is unique to the person Department know organization it's assigned to most digital signatures are used for PDF signing but in some cases they can be used for word excel email documents and in those cases you need a separate certificate for signing those applications lastly you may or may not need a digital digital signature workflow engine a digital signature workflow engine leverages the use of digital certificate on top of a signing platform that manages the entire signing life cycle for you but since these workflow engines can be pretty expensive most companies small or medium choose to Leverage The buil-in signing engines that come with the Microsoft Office Solutions as well as the Adobe PDF software so even though digital certificates can be stored locally on your computers for maximum security digal certificate can also be stored on cryptography Hardware such as a USB smart cards or Hardware security module or an HSM as we call it based Solutions are best suited for individuals or departments that need to sign a moderate amount of documents the benefits to storing the certificant on a include security portability and convenience HSM based Solutions are best suited for organizations that need judicially sign large volumes of documents used in conjunction with either an internally developed or off-the-shelf automated PDF signature software such as Adobe life cycle or asseria digal signatures can be stly applied to a large number of documents such as bank statements or bills or creation organizations who do not have the internal resources or desire to maintain an on-premise HSM may prefer to use a hosted solution where a thirdparty significate Authority hosts a virtual HSM containing the organization signing keys in this case the certificate Authority is responsible for maintaining the security around the HSM and meeting the pki Baseline requirements for the signing keys so your organization doesn't have to posted Solutions offer an easy to implement cost-effective alternative to a fully owned and operated HSM so what's the ideal digital signature solution well the ideal digital signature solution is the one that provides costeffective digital signatures to sign multiple file types you typically use of course it should be easy to use it should offer zero or Next To None resistance for all types of users because we all have to agree that the last thing you want to add to uh to your company business is to add a new workflow for your users and complicate things it should also offer multiple signature options sometimes you would like to keep the signing processes and procedures inside your organization in that case you would like a solution that works locally it should still be easily manageable in a way that best suits your internal processes and provide options to integrate with HR ID security policies and user Management systems such as active directory the solution should easily validate all signatures in the least intrusive manner as possible and of course when it comes to standards the solutions must comply with the dis signature standards these standards are used to ensure the Integrity of the electronic documents as well as the identity of the signer and they are typically adopted by governments Industries and software vendors all around the world lastly the solution should support your organization's existing policies procedures and Technologies and work with existing complimentary Technologies so the burning question here is where should you or your organization start well I want to say you should definitely start by asking the right questions you first got to figure out what are your typical use cases what are your most commonly used applications and processes that today require paper based signatures how many users or how many signatures are we talking about are there any potential deployment costs product costs training renewal support costs that one has to Bear up front what are the typical installation times that would have minimal impact on your existing it maintenance for those of you thinking on how do I deploy this to potentially hundreds of thousands of your employees think about this you already have an onboarding plan in place your HR and IT work together on creating the right HR and IT policies and you already have a user directory or a management system in place like active directory the candidate who will be using the disal signature solution is already vetted in your organization all right so so if any of the things I talked about today were confusing to you or if you still have any more questions please feel free to get in touch with us directly definitely check our website .global sign.com or follow us on any social media networks to get the most upto-date information on such topics now let's take a look at the questions that some of you have submitted in the chat box one of the first questions we have is um Can people share certificates well well to answer that um I want to say that certificates are are issued to either either an individual or an organization or in department so certificates are you know typically when it comes to organizations if you need one or multiple people to sign the same document with the same identity you could go with an organization or a department sign certificate um and you can add multiple people to be to use that certificate the second question we have here is how does this solution compare to other Solutions out there like doy sign or ARX cosign um well there are multiple Solutions out there for additionally signing documents a global sign solution is certificate based and it includes a trusted third-party timestamp so the only software you essentially need once you have your certificate is the software you use to create the document for example in this case it could be a Microsoft Office document or a novy PDF file there are many solutions out there that work um you know a little bit differently and they don't use certificate based authentication um and I'm sure you know there are companies out there that also let people upload their documents which in in my opinion uh no one should be doing all right um now the other question is what's the pricing model um how does pricing work in this in this scenario H well when it comes to pricing you know you generally it's based on uh per certificate and the price depends on the validity of period of the certificates which can be anywhere between one to three years um it also depends on the total number of certificates needed and the volumes of signatures per year um so in case your organizations had has thousands of employees that sign thousands of documents every year the pricing changes ingly