October 19, 2015 By Fran Howarth 2 min read

This week marks the fourth of National Cyber Security Awareness Month (NCSAM), which is held every October in an effort to engage and educate the public about issues surrounding cybersecurity. The theme of week four is “Your evolving digital life.” One of the main security controls that is poised to ease security concerns in the future is the use of more secure authentication mechanisms.

Increasing Connectivity

Today, the use of mobile devices such as smartphones and tablets appears to be almost ubiquitous. Digitization is progressing rapidly and will soon become part of our everyday lives in the form of wearables, smart homes and connected cars and medical devices. The impact will be huge.

According to the Pew Research Center, increasing digitization will revolutionize most human interaction over the next decade, impacting health care, education, work, politics, economics and entertainment in particular. This is the vision of the Internet of Things (IoT), where technology is pervasive and billions of devices are connected to the Internet. While that connectivity will have a positive impact in many areas, there is also a downside in terms of security as greater connectivity will attract attackers who wish to take advantage of our evolving digital lives.

Technology has created great convenience, allowing workers to be more productive from anywhere and enabling instant communication. But enhanced connectivity means that our identities and privacy can be negatively affected, and in some cases, identities can be stolen. A solution is needed to ensure that online identities are more adequately protected in the future than they are at present.

New Methods of Authentication Required

The primary method of authentication for protecting our identities, the devices we use and the resources we access is a username and password combination. But as digitization continues to expand, the sheer number of credentials that we need to remember and manage can become overwhelming.

Different applications and services have their own requirements for passwords in terms of complexity and how often they must be changed. Faced with this situation, many people resort to insecure password management practices such as writing down hard-to-remember passwords or using the same code for multiple services.

To improve this situation and access sensitive applications and services, many service providers require the use of stronger forms of authentication. For many years, hardware security tokens have been the main mechanism used. But these are expensive to provision, and such tokens are generally only used for one discrete application. Because of this, software-based tokens with one-time passwords have come into greater use, often sent to users via mobile phones. Even this can be an inconvenience since the user generally has to pay for this service every time a passcode is generated.

One authentication option that is growing in use is biometrics, helped by the inclusion of fingerprint sensors in mobile phones by many major hardware manufacturers, as well as by service providers such as banks that are increasingly issuing mobile apps that require biometric authentication. According to ABI Research, shipments of fingerprint sensors for smartphones will reach 1 billion by 2020, translating to a cumulative average annual growth of 17 percent. Other forms of biometric identifiers are also seeing growth, including iris recognition in access control for health care applications.

Although slow to take off, owing in part to cost and security concerns, biometric authentication appears to be finally coming into its own. By building sensors into more devices, consumers will further appreciate the speed and convenience that biometrics offer, which will do much to boost security as digital lives continue to evolve.

More from Identity & Access

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments

4 min read - Overprivileged plaintext credentials left on display in 33% of X-Force adversary simulations Adversaries are constantly seeking to improve their productivity margins, but new data from IBM X-Force suggests they aren’t exclusively leaning on sophistication to do so. Simple yet reliable tactics that offer ease of use and often direct access to privileged environments are still heavily relied upon. Today X-Force released the 2023 Cloud Threat Landscape Report, detailing common trends and top threats observed against cloud environments over the past…

Artificial intelligence threats in identity management

4 min read - The 2023 Identity Security Threat Landscape Report from CyberArk identified some valuable insights. 2,300 security professionals surveyed responded with some sobering figures: 68% are concerned about insider threats from employee layoffs and churn 99% expect some type of identity compromise driven by financial cutbacks, geopolitical factors, cloud applications and hybrid work environments 74% are concerned about confidential data loss through employees, ex-employees and third-party vendors. Additionally, many feel digital identity proliferation is on the rise and the attack surface is…

X-Force certified containment: Responding to AD CS attacks

6 min read - This post was made possible through the contributions of Joseph Spero and Thanassis Diogos. In June 2023, IBM Security X-Force responded to an incident where a client had received alerts from their security tooling regarding potential malicious activity originating from a system within their network targeting a domain controller. X-Force analysis revealed that an attacker gained access to the client network through a VPN connection using a third-party IT management account. The IT management account had multi-factor authentication (MFA) disabled…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today