Digital Signature Assurance Agreement Made Easy

Digital signature assurance agreement

hello and welcome to global science webinar making the case for digital signatures I'm Janine Marquis with the global side marketing team and I want to thank you all for joining us today I'd like to take a moment and introduce our presenter Sid Desai he is our director of sales engineering and is responsible for leading a team of engineers helping our customers implement advanced manage pki solutions would like you guys to all interact with us so if you have any questions at all throughout the presentation please go ahead and submit them using the GoToWebinar question box will keep track and try to answer them all at the end of the webinar will also be recording today's webinar and will ensure everyone receives a recorded copy at the end of the webinar so take a minute today to cover some of the topics that you learn during today's webinar will go through an introduction into digital signatures and the benefits of implementing them we'll take a behind-the-scenes look at how digital signatures work and we'll look at deployment options available we'll also wrap up with some real life example customer use cases and with that said I'd like to hand it over to Sid to get started with the webinar alright well thank you Janine for that intro so as Janine mentioned my role here at global sign is to help understand and implement NH speaking solutions for our customers so what we've noticed lately is that digital signatures and the ability to digitally sign documents is quite a hot topic but there seems to be a general sense of confusion in this space now some of you on the call here today might represent a private or public organization or perhaps even a government organization no matter how big or small your company is the interest and the type of use cases around digital signatures remain the same the eventual good end goal for anyone who is planning on using digital signatures is to automate resource heavy paper-based signing processes now because we may have audiences here today who may each have their own needs I may not be able to cover each and every possible scenario around the use and deployment of digital signatures but we'll try to cover as much ground as possible so let's dive in so the biggest advantages of switching to a digital signature solution is cost savings most of you may take into account cost of paper as one of the main factors that drives up costs but it doesn't just end there real costs of paper-based signatures do not just include the cost of paper but also the printing photocopying distribution storage scanning and disposal costs almost immediately you start seeing savings that can be achieved by switching to digital signatures now transportation cost savings is also a pretty big advantage in my personal favorite shorten transaction times think about how many times you have had to wait for somebody else to print a piece of document sign it scan it and email it back to you I think we've all been there on the waiting line for somebody else to get back to you with the sign paper only for you to print it again for record keeping so if you're looking at a return of investment by switching to digital signatures here are some stats for you recent industry success stories some of which we'll talk about in the later part of the presentation site millions of dollars being saved in administrative paper related processes seventy-five percent reduction in error rates eighty-five percent reduction in shipping costs and eighty to ninety percent adoption rates amazing in fact in a study on the benefits of e signatures on board research came up with the following numbers with the use of digital signatures it costs twenty dollars less per document compared to paper-based signatures so as we can see the benefits are plenty so apart from the cost savings there's also some soft benefits associated with the overall improved customer experience you really want your customers to be happy and satisfied and cut back on the actual cycle times of the processes that you have undergoing there's not only improves compliance but also reduces environmental impact just to name a few alright so now that we have talked about the cost savings and the market drivers let's do a quick overview on what digital signatures are firstly you have to understand that not all electronic signatures are digital signatures electronic signature is a broad term used to refer to any type of digitized version of a physical signature and can be as simple as a scan image of somebody signature the signature may or may not be verified by a third party and often do not contain any measures to prevent changes to the document digital signatures on the other hand are a more secure type of electronic signature in are based on public key infrastructure pki technology so when someone receives a digitally signed document he or she knows where the document came from via the identity of the signer when it was signed thanks to a third party time stamp that is applied at the time of signing and that the content of the document has not been altered since the signature was applied behind the scenes there are crypto operations applied to the document that keeps it entirely secure we'll take a look at how this works in a couple of slides so there are two main components of a digital signature and this this process and this components kind of stretches out across all different solutions that are out there in the market a digital certificate is one of the main component and the document that you want to sign is the other one a digital certificate is kind of a virtual passport a third-party verification entity called a certificate authority such as global sign verifies your identity and issues you a certificate since the certificate is unique to you using it to sign a document is a way to prove yes it's really me signing this document and when you apply a digital signature a crypto operation binds to your digital certificate and the data being signed for example a PDF or any other document into one unique fingerprint the uniqueness of the two components of the signature the signers identity and the data are what makes signatures a viable replacement to wedding signatures let's take a closer look at what that means ok so what when you're signing a document using digital signatures what is it that you're really looking for well one of the first things you should be looking for is that you want assurance that the document hasn't been changed somewhere in the workflow that's integrity you also want assurance that the signer of the document is who we think it is and not somebody else so you want the authenticity from this signature and lastly we basically want assurance that the person who signed the document can't deny the fact that he signed it and that's non-repudiation so before we get into how we satisfy these three criterias let's take a quick look at how a digital signatures work so the crypto process is going on behind the scenes that help digital signatures meet their goals typically work like this when you click sign in a digital document or digital signature compliant programs such as adobe acrobat or microsoft office a unique digital fingerprint called a hash of the document is created using a mathematical algorithm this hatch is a specific to this particular document so even the slightest change in the document would result in a different ash now this hash is later on encrypted using the private key from one of your digital certificates and then the encrypted hash and your public key are combined into a digital signature which is appended to the document the digital eckstine document is now ready to be shared so on the receiving end let's take a look at what happens when somebody opens the document that you visually signed when you're LexA PN opens the document the program automatically uses the signers public key which was included in the digital signature with the document to decrypt the document at hash the program then calculates the new hash for the document if this new hash matches the decrypt that has from step one the program noticed that the document has not been altered with and displays a message that shows the document has been had not been modified since the signature was applied the program will also display the identity of the signer based on the public key that was used to apply the signature so are we meeting our needs let's check for integrity the hash comparison checks if the document has been altered if the hashes are the same with masters check the public key confirms the author's identity and confirms the authenticity of the sender so we're okay there and finally to satisfy non-repudiation if the hash can be decrypted with the public key the document was signed with the corresponding private key which should be in the sole possession of the owner so we've also passed the check so let's take a quick look at what a digitally signed document looks like so here is an example of the digitally signed PDF there are two types of digital signatures applied to this document a certified signature and an approval signature a certified signature has shown in this image here attests to the contents of the document and allows the signer to specify the types of changes allowed to the document to remain certified change options include no changes form fill in only and form fill in and commenting certified signatures are displayed at the top of the PDF as a blue ribbon and a blue bar as shown in this image the name of the signer their organization and the certificate authority is clearly displayed this information is all pulled directly from the public key used to apply the signature excuse me approval signatures which we can see down at the bottom of the PDF are performed when someone signs a document to show content approval and acceptance an approval signature can be customizable to this an image such as your physical signature or an engineering seal for instance if you click through the signature details you can see a note that the document has been modified since it was signed and if the hashes haven't matched meaning the document had been altered in any way you would see a red X at the top of the document rather than a blue ribbon so we often get asked about signature expiration and this is an important topic because digital signatures are tied to digital certificates which have an expiration date or certificates can be revoked so people often worry about what's going to happen to the signature after the certificate is no longer valid well with some signatures want your certificate expires the signature of the document will show a warning indicating that it's no longer valid as indicated by the yellow triangles on the graphic here revoking a certificate will result in something different the signature in this case will break invalidating the signature so how do you survive revocation and exploration cases like these the reason these events cause problems in the first place is because what the software goes to validate the signature it checks the actual validity of the signing certificate at that moment in time even if the signature was actually applied months or years ago now this is not really a problem per se because that's the true nature of certificates in digital signatures but you really want to choose a digital signature option in long-term validity or a trusted third party tip and a digital signature move these options will allow the signature to be varied even after the certificate has actually expired now revocation works a little bit differently because you wouldn't want that certificate on that signature to be trusted if the certificate is revoked in any way so now that we've seen the technology behind digital signatures and how they work let's take a look at how to actually implement these in your environment so let's first talk about the client-side option so the client read client-side option is ideally used for louisville lower volume signing the signing certificate is usually stored on a USB token and signatures are most often applied using a desktop application like adobe acrobat or an in-house custom creation now there are also industry specific applications like Blue Beam that a lot of people use for engineering applications and most clients like deployments are common when a individual person needs to sign on something for example an engineering firm that needs each engineer to sign off on project plans lab reports and biopharma insurance documentation for health care professions and so on so let's look at an example to understand this use case so we work with the customer called khlo Harbor and associates as in many engineering and architectural firms claw harbor and associates their engineers actually go through manually signed fabulous of engineering drawings that ultimately get converted to a PDF or final distribution and archiving now the document delivery process was time consuming and not conducive to meeting tight deadlines finalized documents required an engineering seal on every page as well as signature of the professional engineer that authored and or approved the document now after the process was complete the document was forwarded to see a TAS document production center where it would be scanned into a PDF and printed several hundred times what globalsign did is offered a solution where our PDF signing solution allowed chha to digitally sign PDFs within Adobe Acrobat entirely eliminating the need to sign each physical document and then scan it into a PDF the solution is complied with state regulations surrounding digital signatures and save CH a a lot of time and resources so let's take a look at the server side use case the server side option is ideal for companies using an internally developed on or off the shelf automated document generation software and this software is generally used to generate and manage large volumes of documents typically the signing certificate is typically stored on an HSM on hardware security module and global science supports on-premise HSM deployments but also offer an hosted option for DHS MS where the signing credential is actually stored on a virtualization partition server side deployments are commonly used for certifying signatures when you want to lock down the document from future changes and usually use a company or departmental credential for example an insurance company that might digitally sign all new insurance applications so let's take a look at an example in this case it so Colombian Mutual Life Insurance Company is one of our customers and the challenge they had was they wanted to improve the quality of new business submissions and reduce the turnaround time for application submission to commission payment and delivery of the issue policy to the customer to achieve these goals they sought a digital signature solution to replace the existing paper-based workflows so Colombians digital signature implementation needed to be able to produce a digitally signed and timestamp document with similar legal integrity as a signed paper application now to encourage agents to adopt this new online application as a replacement to paper-based processes that they were comfortable with it was imperative that the digital signature be fast be painless and instantly recognizable as a valid by any PDF reader any PDF application so the solution that global sign offered is since Colombia mutual is using serve server-based solution there is no need for any tokens or additional hardware to apply a signature the signing certificate is stored and protected on a hardware security module hosted by global sign and the sales agent reviews a policy application with the customer and upon approval from the customer for the content uploads the application to the signing server with a click of a button so the signing server on the other hand converts the application to PDF timestamps and applies the company's digital signature by talking to the hsm on the cloud the policy is complete within minutes significantly decreasing turnaround time compared to traditional paper-based methods so this is how this is what Goldust and offered to Colombian life and life mutual to help them with their digitally signing documents so this pretty much brings us to the end of this presentation material I would like to say though before we take any questions all of this material including the case studies that we just saw today we discuss today are all available in the PDF form on our website and I'm sure Janine will be able to give you more details around that so over to you journey great Thank You SID that was there was a lot of great information I hope this webinar helps all of our listeners today understand what digital signatures are how they work and how they may be able to benefit from implementing digital signatures into their organization so we'll go ahead and take any questions that anyone has at this time we did get a question regarding and Sid mentioned the slides of the webinar will be available on our website what we'll go ahead and do is if you registered for the webinar will email you a copy of the live webinar recording as well as a slide deck that you can download so we hope to have that email out within the next day or so let's take a look at some of the questions here the first question we have here can multiple users share digital certificates for digital signatures yeah that's a very good question so certificates are issued to actual individual or an organization or department so if you have you know if you need one or multiple people to sign using the same kind of signature what you can do is you can have the organization or a department signed certificate and you can have multiple people use that same certificate to sign the document so yes the answer is you can definitely have multiple users share a single certificate we've covered this question a little bit but maybe we can touch upon it what type of documents can you apply digital signatures to are there any restrictions well you can sign multiple types of documents Adobe PDF is is wildly used with all our customers and a lot of our customers also use Microsoft Office or any other type of word processing systems but for the most part if they're looking to have some kind of digital documentation and the PDF format Adobe PDF is the most widely used standard great we're getting a few questions surrounding some of the new regulations that are out regarding the EEI das regulation which I think Sid will probably have to do a little bit more research into but some questions about how companies can comply with the new regulations and what would be the main problems with the new regulation yeah so that that's a fair question janina i think that there's a bit more research that we have to do on our end because there's a lot of regulations in different countries we've had customers talked to us from the european region who each european region has a different type of standard that they operate on and so we have to comply with all the all of these standards the good part about using a digital certificate based solution is it's widely acceptable across all standards so as long as you can issue an identity or a certificate to a company or a user that can certify that that user or the company it should be valid throughout any standard okay and yeah for these these questions that we need to do a little bit more research on or we can specifically talk to reach out to these individuals provide more details for specific use cases and the next question is but a few more that came in how do you employ the signing of a document by the vendor and the customer i am i'm not sure Sid I think that may be speaking directly to maybe putting into a betta a be to seek use case so we may need to defer the quare clarify that question yeah I didn't quite get the the question so if you wouldn't mind repeating I can try to you know provide at least an absence yeah mmm the attendee put another comment in in essence signing at different times with the document going back and forth okay perfect yeah so you can definitely have that you can have multiple signatures on the document and the document can be signed by multiple users at different time scales so yes we do support that great and there was one other question does my recipient need special software to receive my digitally signed document know the good the good thing about visually signed documents is the recipient of your document they don't really need any additional software for example a regular adobe reader adobe PDF should just do fine and they can verify the signatures right on the adobe program great we have it we haven't received any other questions but if anyone has any questions please feel free to reach out reach out to us directly and again we'll send out an email within the next day or two with the recorded version of the webinar and thank you again everyone for your time today