John Barco

Do Not Rely On Passwords To Protect Your Online Information

Do Not Rely On Passwords

Simple passwords are no longer safe to use online. John Barco, vice president of Global Product Marketing at ForgeRock, explains why it’s time the industry embraced more advanced identity-centric solutions that improve the customer experience while also providing stronger security.

Since the beginning of logins, consumers have used a simple username and password to secure their sensitive information across the Internet. This approach made do in the early days of ecommerce, but with the rampant growth of phishing and other fraudulent activity, it’s time for a new industry standard. For businesses everywhere, this need for change has created important questions about how to protect sensitive information in a cost-effective manner, without diluting customer usability and convenience.

Everyone is on mobile, which calls for more security on-the-go

The mass adoption of mobile devices presents the most obvious need for greater online security control. The sheer number of mobile devices around the world means organizations can implement more robust, two-factor or multi-factor authentication systems without having to worry about the high cost of providing the devices to consumers themselves. Under a two-factor authentication system, traditional usernames and passwords remain the first step in identity verification, but users are then required to input a second authentication factor to further verify who they are. This involves sending a unique code or password to a user’s mobile device; the user must input this along with his or her credentials to be granted access. Multi-factor authentication systems such as the Apple iPhone TouchID add a biometric factor such as a fingerprint.

Mobile-based authentication, which is gradually becoming the benchmark standard for online businesses, gives peace of mind to consumers. However, such authentication is not without its issues. Mobile devices are not always secure, and unfortunately, a growing volume of malware is specifically programmed to target them. Such malware can allow criminals to scrape verification codes directly from devices if the codes are sent over data networks. The impact of mobile-based authentication on the user experience is also a concern, as many consumers do not want to have to enter multiple passwords every time they access their online accounts.

Next-gen security goes biometric

Adding biometric layers such as fingerprint or facial recognition technology, or messaging-based authentication processes could be the answer to the woes of mobile-based authentication. Biometrics could further boost security, with minimal impact on the user experience. As pointed out in a recent Gartner report, “Smartphone devices can make use of network-based push notification services that provide a secure out-of-band authentication channel. Authentication servers send notifications via the smartphone OS vendor. These messages are routed to a preregistered device and awaken a local app that can further authenticate the user via contextual information, PIN/password or biometric method. After successful local authentication, the app notifies the requesting authentication service of success, which completes the out of band (OOB) loop.” High-end smartphones offer these capabilities, but until they are more widely available, biometric authentication is unfortunately unlikely to be a viable solution for the majority of consumers.

Another alternative is to add extra layers, such as push authentication, to the two-factor process; this increases security but does not impact the customer experience. When first-time consumers sign into a website that uses push authentication, they will be asked to scan an on-screen Quick Response (QR) code with their mobile devices. This creates an ‘ID tether’ between users and their devices. The next time the user logs in, a push notification is sent to his or her device; all the user has to do is tap ‘approve’ in order to proceed. Importantly, these messages are usually sent over a different network, usually the cellular network, making interception by malware or other criminal monitoring of data activity extremely difficult.

Behavior-based monitoring will become an industry standard

Do Not Rely On Passwords

(Image Source: Shutterstock)

End users’ demand for multifactor authentication has accelerated in recent months, and businesses are more aware of the threats posed by online criminal activity, which makes major news headlines almost daily. Multifactor authentication, however, still relies upon a lock and key approach to online security. This means that once someone is through the front door (i.e., they have gained entry to the account), there are usually no other obstacles between them and the sensitive data contained within. For these reasons the most forward-thinking organizations are looking to implement solutions that offer adaptive risk authentication and continuous security.

Adaptive risk authentication and continuous security provide an on-going view of online security. Which means that just because someone has gained access to an account, it does not mean they have full and free access to the data within the account. Adaptive risk authentication scores user behavior based on key criteria such as IP address, device ID, number of failed login attempts and more to establish if the behavior is consistent with established ‘normal’ user behavior patterns. Any deviations outside of the norm result in a higher risk score, which triggers additional security questions, re-authentication or, if necessary, the removal of the token assigned to the online session. Most importantly, algorithms responsible for scoring each session run silently in the background. Users are only made aware of them if their behavior is deemed to be suspicious. The user experience is not compromised in any way, despite the higher levels of security in place.

Usernames and passwords are not dead just yet. They will continue to have their place online for a while, but it is increasingly obvious that in isolation, they are no longer enough to keep sensitive information safe. Thankfully for consumers, advanced security such as multifactor authentication, adaptive risk and continuous security is on the horizon. Inevitably, even the most robust lock-and-key solutions will give way to more reliable behavior-based monitoring, as the fight to keep sensitive data secure online continues to evolve.

By John Barco

John Barco

John Barco is vice president of Global Product Marketing at ForgeRock. John has 20+ years of experience building innovative products for enterprise customers, focusing on identity and access management for the last 12 years. Prior to joining ForgeRock, he served as Senior Director of Product Management for the Identity Management group at Sun. John has also held leadership positions at iPlanet, Silicon Graphics, NComputing, and IronKey. He holds a degree in industrial engineering from Missouri State University.

Mitigating Cyberattacks: The Prevention and Handling

Mitigating Cyberattacks: The Prevention and Handling

Mitigating Cyberattacks New tools and technologies help companies in their drive to improve performance, cut costs and grow their businesses but as companies adopt cloud services in greater numbers and refine internal processes for development ...
The Unintended – and Intended – Consequences of Cloud Data Sovereignty

The Unintended – and Intended – Consequences of Cloud Data Sovereignty

Cloud Data Sovereignty It seems that everything has unintended consequences – whether positive or negative. Intended consequences are those that are chosen. Unintended consequences are forced upon us. The consequences surrounding data sovereignty regulations are ...
Avoiding the IOT ‘Twister’ Business Strategy

Avoiding the IOT ‘Twister’ Business Strategy

IOT ‘Twister’ Most organizations’ ‪ IOT Strategy look like a game of ‪ ‘Twister’ with progress across important IOT capabilities such as architecture, technology, data, ‪ analytics and governance; variables comprising a series of random investments and decisions. There is something ...
Malware Will Cripple Cloud And IoT Infrastructure If Not Contained

Malware Will Cripple Cloud And IoT Infrastructure If Not Contained

The Malware Cloud Concern This year we’ve had two cyber attacks in which malware was used to cripple government computer systems. Unless counter-measures are deployed, similar malware attacks can be used against cloud and IoT ...
Protect Against Network Failures

Five Things Organizations Can Do To Protect Against Network Failures

Protect Against Network Failures It is no surprise that whenever there is an outage in a public or private cloud, organizations lose business, face the wrath of angry customers and take a hit on their ...
The Lighter Side Of The Cloud - Big Broadband
The Lighter Side Of The Cloud - Techwear
The Lighter Side Of The Cloud - The Apple Watch
The Lighter Side Of The Cloud - Checking It Twice
The Lighter Side Of The Cloud - Passwords
Cloud Marketing Professional
The Lighter Side Of The Cloud - Car Troubles
The Lighter Side Of The Cloud - The Dating Game
The Lighter Side Of The Cloud - Autonomous Sleigh

CLOUDBUZZ NEWS

Oracle Blockchain Cloud Service and Financial Services Enable Next-Gen Blockchain Innovators

Oracle Blockchain Cloud Service and Financial Services Enable Next-Gen Blockchain Innovators

Students Tackle Real Problems and Succeed in Blockchain Challenge In an effort to accelerate blockchain innovation in Financial Services and other industries, Oracle recently joined academia and banking industry leaders as part of the Carolina Fintech ...
Cambridge Analytica files for bankruptcy in U.S. following Facebook debacle

Cambridge Analytica files for bankruptcy in U.S. following Facebook debacle

(Reuters) - Cambridge Analytica, the political consultancy at the center of Facebook Inc’s (FB.O) privacy scandal, filed for Chapter 7 bankruptcy in the United States late on Thursday. This past March allegations surfaced that Cambridge ...
China Approves Toshiba's $18 Billion Sale of Its Memory-Chip Unit

China Approves Toshiba’s $18 Billion Sale of Its Memory-Chip Unit

TOKYO—Private-equity firm Bain Capital received approval from Chinese antitrust regulators for its deal to buy Toshiba Corp.’s memory-chip unit, a person familiar with the matter said Thursday. A Bain-led consortium reached the $18 billion deal ...