Adaptive two-factor authentication: is it all it's cracked up to be?
NEW YORK, N.Y., Oct. 20, 2015 (GLOBE NEWSWIRE) -- It's a given that employee access to corporate systems should be both as secure and simple as possible. Up until recently however, time-strapped CIOs, under pressure from demanding staff and challenged with authenticating users all over the world on multiple devices, have been torn between relying on the fatally flawed password or hard token two-factor authentication (2FA) to keep their systems secure.
Recently, adaptive authentication has gained in popularity, as it reduces the time it takes to log-in by verifying a user based on their location. But is this the best solution?
Adaptive authentication works by granting users access using just their user name and password if they are in a trusted location. Although in theory this process makes it easier for a user to authenticate their identity, there are several issues with this technology, which many may not realise.
From an end-user prospective, they want speed, stability and consistency in their log-in methods. If a user attempts to verify their identity using adaptive authentication in a non-trusted location, they will be asked to use the full 2FA process. This will require them to enter a code generated on a soft or hard token depending on the technology used. If the user is using the full process less than once a week however, they are likely to run into complications – forgetting how the process works or even to bring their hard token if one is required.
Despite this, a small number of users, usually those who are based at home but travel frequently, login at multiple locations, multiple times a day. In this instance, adaptive authentication can prove its value, as a user will feel the benefit of a fast login process in trusted locations, whilst using the full 2FA process frequently enough to be familiar with it.
There are three ways of achieving adaptive authentication, and it's important for CIOs to consider the differences.
The first is to detect a user's geo position via their IP address. The process, called GeoIP, has its own issues. Internet service provides often change IP addresses of private users to prevent them from running their own servers at home. This means that when an IP address is switched, a user's location could appear to be somewhere 200 miles away, flagging them as now being in an unsecure location. The home of the user now assigned to the old IP address, has also suddenly become a trusted site.
Corporate offices and buildings will usually have just one external IP address and several internal addresses. These internal addresses are not made available externally, which means that to make a corporate location trusted, anyone in that office is then identified as a trusted user.
The second method is to use GPS location. This method requires an app to be installed on a user's mobile device. Whilst this is infinitely more precise, employers can track the location of their staff whenever the device is on, raising serious questions on privacy.
The future of adaptive outreach is to use the local base transceiver station's GSM Cell ID to identify the location of a user's mobile phone, and therefore verify their identity. With this method, neither the organisation, nor the two-factor authentication security provider knows the location of the user. Instead, the security provider sends a request to the mobile operator asking whether a user's mobile phone is within a trusted cell. The operator will simultaneously come back and say either yes or no, never revealing which cell they are in. If no, the user will be prompted so sign in using the full 2FA method.
Individuals already trust their mobile network provider to keep their location secure, and this way their location data never leaves its sphere of trust.
The ultimate solution for both the CIO and the end-user's needs is an authentication method that's so quick, simple and secure, there's no need for it to be adaptive. Near Field Communication (NFC)-based mobile authentication for example, can securely transfer all the information required to enable a browser to start up, connect to the required URL, and then automatically enter the user id, password and second factor passcode in one seamless logon.
NFC isn't just limited to mobile phones either. Wearable technology, highly personal in nature, can also be utilised, enabling users to authenticate using their smart watch by simply tapping their wrists against a corresponding device.
This effectively creates a solution that's even quicker than entering a simple user name and password. The CIO is then safe in the knowledge that their end points are covered, and the user is happy authenticating their way. So question, is adaptive authentication as secure as it should be an everything its cracked up to be?
More: http://www.scmagazineuk.com/
About SecurEnvoy
SecurEnvoy (www.securenvoy.com) is the trusted global leader of mobile phone-based Tokenless® two-factor authentication. Its innovative approach to the multi-factor authentication market now sees millions of users benefitting from its solutions all over the world. Controlling endpoints located across five continents, SecurEnvoy design innovative two-step verification solutions that leverage both the device the user carries with them and their existing infrastructure. The solutions are the fastest to deploy and the most secure in the industry. With no hardware or deployment issues, the ROI is dramatically reduced and easily managed.
CONTACT: SecurEnvoy 373 Park Ave South New York, NY 10016 General Information: E info@SecurEnvoy.com T (866)777-6211
Related Web URL: http://globenewswire.com/news-release/2015/10/20/7...
