Let’s face it: Authentication factors as we know them are not holding down the fort. The practice of providing something you know, something you have and something you are is failing, even when we are asked repeatedly to provide multiple factors of authentication.

Passing Around Passwords

Passwords are a dying breed. The excessive use of passwords, coupled with the need to make them complex and replace them every few months, has driven many users to recycle them across various services. In fact, according to the “TeleSign Consumer Account Security Report 2016,” 71 percent of accounts are guarded by passwords that are used across multiple sites. So when a password is compromised due to a phishing attack or data breach, multiple accounts belonging to that user are also at risk.

Knowledge-based authentication (KBA) makes up the other piece of the “something you know” requirement. According to the TeleSign report, 56 percent of users consider KBA to be their preferred means of additional authentication. Gartner research, however, found that users fail to answer their knowledge-based questions 15–30 percent of the time, while fraudsters answer correctly 60 percent of the time. Malicious actors often find this information on social networks or through phishing schemes.

Shifting Away From SMS Authentication

To fulfill the “something you have” requirement, we used to have physical tokens that generated different one-time passwords (OTPs) every 60 seconds. This practice has shifted to mobile phones, with OTPs being sent as text messages. However, mobile malware can intercept these messages and forward them to fraudsters.

This growing threat influenced the National Institute of Standard and Technology (NIST) to recommend a shift away from SMS-based OTPs.

Sticky Fingers

Biometric authentication is cool. It’s easier to use than other forms of authentication and can be much more secure. Or is it?

It is definitely easier to use fingerprint readers, for example, than to type, which has led to the exponential growth of fingerprint reader-enabled devices. It didn’t take long, however, for cybercriminals to circumvent this technology. Moreover, if the biometrics enrollment process is not properly secured, a cybercriminal — or even a young child — can register his or her own fingerprints with a victim’s password.

Trust, but Verify

New technologies such as behavioral biometrics, which identify anomalies in users’ ongoing behavior, have the potential to replace passwords and help organizations avoid compromise. However, in the cat-and-mouse game of cybercrime, it’s only a matter of time before threat actors devise behavior replay attacks or other forms of circumvention. Isn’t there a better way to manage secure identities rather than continuing to add more hoops for users to jump through?

Read the white paper: Outsmarting Fraudsters with Cognitive Fraud Detection

The key is not in what strategies we use, but rather in how we use them. While users can provide proof of their identities, so, too, can the malicious actors who compromise them; that’s where the principle of “trust, but verify” comes in. When users enter their passwords or use known devices, there should be indicators of malicious intent if the information is being submitted by a fraudster.

Here are a few examples:

  • For “something you know” credentials, indicators should show whether users have been phished or otherwise infected with malware, which would suggest that their credentials may have been stolen.
  • For “something you have,” indicators should help analysts determine whether a user’s device has been compromised by malware or another means of stealing SMS messages. This should put any OTP response by the user in question. In addition, evidence of device-identifying parameters being spoofed or of remote-access Trojans (RATs) being used may indicate that the user’s known-devices identification has been compromised.
  • For “something you are,” it’s critical to identify particular biometrics, such as a specific fingerprints, associated with multiple accounts of various users.

A Complete Identity Picture

When such indicators are coupled with traditional authentication factors, they paint a more holistic picture of identity corroboration, one that shows not only the bright colors of the positive identity indicators, but also the shadows of malicious actors. This delivers a much higher level of trust in the established identity picture. IBM Security’s Identity and Access Management and identity analytics solutions can provide this complete picture.

To keep the identity corroboration process effective, however, it must adapt continuously to identify new attack and risk indicators — but that’s a topic for another post.

More from Fraud Protection

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today