By adopting a proactive and risk-based approach to identity security based on biometric authentication, blockchain-based identity management, AI, and more, businesses can create a more secure and trustworthy environment for their employees and customers.
Gartner predicts over half of significant cyber events in the next few years will be caused by human factors in its latest report on cybersecurity. A report from Verizon was even more dire—citing human factors in 82% of breaches.
As companies undergo digital transformation efforts, significant cyber attack incidents are increasing in frequency. In just the first part of 2023, major companies like Chick-Fil-A, T-Mobile, MailChimp, and Activision experienced significant data breaches, with several a direct result of human error. Moving forward, companies will need the latest best practices in identity security to prevent future incidents. Here are the foundations that will inform their cybersecurity strategies.
Using multifactor authentication the right way
Microsoft’s Director of Identity Standards, Pamela Dingle, mentioned in her 2022 Authenticate Conference keynote that identity threats will decrease in volume as they become more complex. Unfortunately, one of the biggest ways threat actors succeed in breaches is through a simple password-based strategy.
Password attacks cost nothing and aren’t particularly sophisticated by themselves. Instead, hackers rely on a spray-and-pray method to find loopholes. This causes major damage. The 2023 MailChimp breach used social engineering to gain access to employee passwords and then access to over 100 customer accounts.
Where traditional authentication requires only a username and password, MFA is a security mechanism that requires users to provide multiple forms of identification to access their accounts or systems. It typically requires users to provide at least two of the following factors to verify their identity:
- Something the user knows, such as a password or PIN
- Something the user has, such as a smart card, token, or mobile phone
- Something the user is, such as a biometric factor like a fingerprint or facial recognition
By requiring multiple forms of identification, MFA adds an extra layer of security to the authentication process, making it more difficult for unauthorized users to access sensitive data or systems.
While it’s possible to target accounts with MFA, threat actors must attack MFA itself. This is much harder and more time-consuming to do than traditional password attacks. Using the right MFA strategies for company authentication is key to preventing accidental authentication and further frustrating typical attacks.
Moving towards a password-less future
While it’s unrealistic to believe that 2023 will be the end of the password, companies must understand that a passwordless future is inevitable. The HIPAA Journal notes that 41% of organizations improved security using password-less approaches, 24% improved user experiences, and 17% reduced burdens on IT. A passwordless future for companies would mean moving beyond traditional password-based authentication methods and adopting more secure and user-friendly alternatives. In addition to MFA, here are some of the key features of a password-less future for companies:
- Biometric Authentication: Biometric authentication methods, such as facial recognition or fingerprint scanning, could replace traditional passwords. Biometric authentication is more secure than passwords because biometric factors are unique to each user and cannot be easily duplicated or stolen.
- Risk-Based Authentication: Risk-based authentication is a type of authentication that evaluates the risk level of each authentication attempt and adapts the authentication process accordingly. This could involve analyzing various factors, such as the user’s behavior, device, location, and the sensitivity of the requested data.
- Zero Trust Security: In a passwordless future, companies could adopt a zero-trust security model, which assumes that all users and devices are untrusted until proven otherwise. This would involve using advanced security measures, such as micro-segmentation and continuous authentication, to protect against potential threats.
Overall, a passwordless future for companies would provide greater security and convenience for users while reducing the risk of password-related cyber attacks. It would require adopting new technologies and authentication methods, as well as a shift in mindset towards a more proactive and risk-based approach to security.
See also: Cybersecurity Will Shift in 2023 Thanks to AI
Integrating artificial intelligence and machine learning
Risk-based authentication mentioned in the list above leverages AI and ML to evaluate the risk level of each authentication attempt and adapt the authentication process accordingly. This could involve analyzing various factors, such as the user’s behavior, device, location, and the sensitivity of the requested data. But this isn’t the only use case for AI/ML-supported identity security.
Artificial intelligence (AI) and machine learning (ML) are increasingly being used in Identity Access Management (IAM) systems to enhance security and improve the user experience. Here are some other ways AI and ML fit into IAM:
- Behavioral Analytics: AI and ML can be used to analyze user behavior and detect anomalies that could indicate fraudulent activity. By analyzing factors such as login time, location, and device, AI and ML can create a unique user profile and detect any unusual activity that deviates from the user’s normal behavior.
- Adaptive Access Control: AI and ML can be used to create adaptive access control policies that automatically adjust the level of access based on the user’s behavior and risk level. For example, if a user is attempting to access sensitive data from an unknown location, the system could require additional authentication methods to ensure that the user is authorized to access the data.
- Identity Verification: AI and ML can be used to verify the identity of users through various biometric factors such as facial recognition or voice recognition. This can provide a more secure and user-friendly authentication experience than traditional password-based authentication.
Unified approaches to identity sprawl
Identity sprawl is a common challenge many companies face in managing their identity and access management (IAM) systems. It refers to the proliferation of identities across various systems, applications, and devices, making it difficult for organizations to manage and secure them effectively. Gartner and enterprise Identity Data Fabric company Radiant Logic surveyed IT leaders in August 2022. They discovered that 60% of organizations have over 21 disparate identities per user, making authentication complex and time-consuming.
Unified security can help companies address identity sprawl by providing a single platform that enables centralized management and control over all identities and access rights. Here are some ways that companies can use unified security to address identity sprawl:
- Centralized Identity Management: A unified security platform can provide a centralized identity management system that enables companies to manage all identities across different systems and applications from a single location. This allows for more efficient management and greater control over who has access to what resources.
- Single Sign-On: A unified security platform can also enable single sign-on (SSO) capabilities, which allow users to access multiple applications and systems with a single set of credentials. This reduces the need for users to remember multiple usernames and passwords, which can increase security and improve user experience.
- Role-Based Access Control (RBAC): A unified security platform can enable RBAC, which allows companies to define and manage roles and access rights for different users and groups. This ensures that users have access to only the resources they need to perform their jobs and reduces the risk of unauthorized access.
- Real-time Monitoring and Alerting: A unified security platform can provide real-time monitoring and alerting capabilities that enable companies to detect and respond to identity-related threats quickly. This includes detecting suspicious behavior and unusual activity, and generating alerts that enable companies to take action before a breach occurs.
Strategizing proactive identity security in 2023
Identity security is an essential aspect of modern-day cybersecurity. The identity security landscape is constantly evolving, and businesses must stay up-to-date with the latest trends and technologies to protect their sensitive data and systems from cyber threats. In 2023 and beyond, we can expect to see an increased focus on biometric authentication, blockchain-based identity management, AI-powered solutions, passwordless authentication, and privacy-preserving technologies.
Businesses will also need to be aware of the latest social engineering attacks and implement best practices such as multifactor authentication and risk-based authentication. By adopting a proactive and risk-based approach to identity security, businesses can create a more secure and trustworthy environment for their employees and customers.
