Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

Authentication Methods
After the user is approved and
given their account credentials,
they need to authenticate
themselves every time they log
into their online accounts. In most
cases, all that’s needed is a simple
username and password. But,
in some situations, businesses
need higher levels of assurance
to ensure that the person making
the request is who they claim to
be. These include:
• Logging in from a foreign
IP address
• Password resets (in light
of account takeovers)
• Large money or wire
transfers
• Multiple unsuccessful
logins
• Requested change on
authorized permissions
• High-risk transactions
(car rentals, hotel room keys)
For these types of transactions,
companies use a variety of
authentication technologies
including:
• Knowledge-based
authentication
• Multi-factor
authentication
• Out of band
authentication (e.g., SMSbased
codes sent to the user’s
smartphone)
• Hardware and software
tokens
A New Paradigm for Identity
Proofing and Authentication
Unfortunately, there’s very
little overlap between the
technologies used for identity
proofing and the technologies
used for authentication. Making
matters worse, many of these
traditional forms of identity
proofing and authentication have
proven to be hackable, insecure
and unreliable thanks to largescale
data breaches, the dark
web and man-in-the-middle
exploits.
This is both unfortunate and
inefficient.
62 Cyber Defense Magazine - Annual Print Edition 2019