adaptive authentication padlock concept

What Is Adaptive Authentication?

Balancing security needs and customer convenience can be a challenge. The more stringent you make your security controls, the more likely you are to frustrate legitimate customers. Fortunately, adaptive authentication provides the security your business needs while allowing a lighter approach to ensure an optimal user experience (UX).

This blog helps answer some of the questions commonly raised by our customers by using real-life digital banking examples.

What Is Adaptive and Risk-Based Authentication?

Adaptive authentication and risk-based authentication are terms that are commonly used interchangeably. They refer to a cybersecurity approach that enforces certain “levels” of authentication depending on several unique factors. Let’s dig a little deeper and explain some of the basics:

  • Authentication — the process of verifying the identity of a customer by confirming or denying the validity to access a system or an application
  • Adaptive or risk-based authentication — adjusting the user authorization challenges or requirements based on predefined approaches and factors. For example, if a customer is trying to perform an international money transfer, he or she will most likely have to provide authentication that goes beyond username and password. It is also possible for a bank to offer the opportunity to adapt the authentication method required based on the device the customer uses to offer additional convenience. This could mean authenticating using the mobile device when banking on mobile or vice versa when on a PC.

For the sake of this article, I will be using “adaptive authentication” to represent both terms.

Adaptive authentication uses numerous factors to define security challenges, some of which could include the following:

  • The customer who is trying to access those systems
  • The specific systems he or she is trying to access and the sensitivity of the information they contain
  • Behavioral biometrics, including clicks on a website or taps on a phone, usual typing speed or swipe gestures
  • Other factors about the access attempt, such as previous login attempts, device type, location and other special circumstances

How Does It Work?

Adaptive authentication uses machine learning algorithms to analyze customer behavior and its environment. The system then combines this with security policies and protocols to determine if additional authentication is required. Cybersecurity teams can update rules and protocols to provide the right balance of security and accessibility.

 

Image
Low RiskMedium RiskHigh RiskACCESSGRANTEDADD FACTORACCESSDENIEDWe recognize you.Enjoy a smoothtransaction!We are not sure. Let’s try something else!Nice try. Access denied, fraudster.HIDAnomalyEngineBehaviorEngineThreatEngineRisk Management Solution

 

When To Use Adaptive Authentication?

Adaptive authentication is ideal for balancing user experience against the need for robust security and data protection. Here are a few use cases as examples:

  • Use single factor (password only) authentication to access account balance
  • Only ask second authentication factor when using a new device for the first time
  • Step up with an additional level of authentication when a series of abnormal factors are detected during a session to prevent fraud
  • Do not block unusual transactions in isolation. If the customer environment and biometric behavior indicate that the user is who he or she claims to be, the transaction can be authorized.

How Does Adaptive Authentication Differ From “Regular” Authentication?

Regular authentication typically requires the same authentication method for everyone, regardless of their situation.

In the world of persistent threats this would typically be multi-factor authentication (MFA); however, by implementing adaptive authentication we can remove this hassle, reduce friction and keep customers engaged by taking into account the varying levels of sensitivity of certain data and transactions.

Adaptive authentication can be one of the best ways to secure your sensitive data and systems. Combined with single sign-on and a strong MFA solution, it provides a largely transparent way to authorize users and only challenge them further when necessary, to offer the best possible user experience.

Want to learn more?

See how the adaptive authentication process works in this infographic >>
Explore a frictionless end-to-end user journey with HID Consumer Authentication >>

RECENT POSTS

HID Origo™ 개발자 포털 소개

HID Origo™ 개발자 포털의 가용성에 대한 소식을 전해 드릴 수 있게 되어 기쁘게 생각합니다. 이 포털에서는 기술 파트너들에게 직원들의 물리적 및 디지털 경험과 기술이 혼재하는 앱과 API 통합을 구축하는 데 필요한 도구와 지원을 제공합니다.

10월은 국가 사이버 보안의 달입니다

매년 10월은 정부와 사이버 보안 업계가 협력을 도모하기 위해 지정한 국가 사이버 보안 인식의 달(NCSAM)입니다. 이 교육 기간 동안 유익한 정보를 통해 기업과 개인이 온라인에서 스스로를 보호할 수 있는 방법에 대한 인식을 고취시킬 수 있습니다.