123456. Amazingly, surveys show that this is the most popular password for authentication. And simple passwords are still the most used authentication method. However, popularity, in this case, just doesn’t equate with success.
Security breaches are becoming a daily occurrence and high profile companies such as Yahoo, Target (was the clue in the name) and Tesco are just some of the famous names amongst the victims of password theft.
Recently, on a Netherlands server, researchers discovered compromised credentials for more than 93,000 websites, including 318,000 Facebook accounts, 70,000 Gmail, Google+ and YouTube accounts, 60,000 Yahoo accounts, 22,000 Twitter accounts and 8,000 LinkedIn accounts. These are just some names from a very long list.
However, these public lists, huge as they are, represent just a fraction of the organisations suffering from password theft. The majority of organisations affected have neither any requirement to notify anyone (as it affects their business and their staff, but not consumers), nor have they been “outed” publicly.
So we have a long established way of doing things, that is proven on a daily basis to be inadequate and insecure, yet the majority of companies still use it. How long will this state of affairs last? Will we see another decade of consistent, repetitive authentication failures?
The short answer is no. The slightly longer answer is that the Darwin principle will ensure that doesn’t happen. Those affected by password theft will either come up to the mark, and improve their authentication, or decline and go out of business.
The real answer is that strong authentication is on a high growth curve, driven by the multiple waves of change rolling across organisations, both small and large.
There are many reasons for these changes. Recent developments in computing have led to increasingly fractured and distributed networks, which are harder to protect. More people are trying to access the network from more locations, so it’s much harder to keep track of who is on the network and whether they have a right to be there.
The reasons for increasingly distributed networks include the growth of mobile computing, remote access, tablets, smartphones and BYOD. The growing popularity of wireless, the cloud, virtualisation and the increasing use of social networking are also making inadequately protected networks easier to breach.
Alongside the increasing insecurity of today’s networks, there has been a rapid growth of data, coupled ironically with both greater dispersal and greater agglomeration of data in data centres, meaning there is even more to protect than ever before.
Authentication is the most basic step towards protecting networks and while passwords still have a role, that role is increasingly as part of a multi-factor authentication process. This is being driven by a range of issues, including rapid changes to risk profiles and greater awareness of two factor authentication.
Authentication types - benefits and disadvantages
Getting the right kind of authentication needs careful thought. A key question is “Is the authentication method something that staff can use relatively easily?” Get something too complicated and you could have problems.
Another key issue is using the right level of authentication needed. Do you need different levels of authentication for different staff, for different applications, for different departments? Is your authentication method flexible enough to cope with that? Broadly speaking, users are looking for authentication methods that provide the best combination of ease-of-use, security, and, of course, cost. Currently, the main options are:
- Weak single-factor authentication (passwords)
- Strong complex passwords, usually with a minimum of characters, including special characters, and recommended to be regularly changed
- Strong two-factor authentication (passwords + something else, such as a token)
- Strong three-factor authentication (passwords + something else, such as a soft token + a mobile phone).
Trends
Contextual authentication
Contextual authentication is a method which is growing, but not yet mainstream. It uses contextual information (such as users’ behaviour patterns) to decide whether a user is genuine. It can improve on the use of a password, without the need for traditional two factor strong authentication.
Mobile devices can play a significant role in contextual authentication. They can capture relevant contextual information such as tapping rhythm, voice recognition, facial contours, and iris details. However, as yet, this kind of mobile-related, contextual authentication is only used for a minority of higher security applications.
A strategic view
A growing trend amongst enterprises is to take a more strategic view of authentication. Companies are acknowledging they may need different levels of authentication for different scenarios, different users and different applications. They are looking for one flexible authentication method which can facilitate these different levels. Currently, however, most enterprises and SMEs still tend to use a single authentication method.
The Cloud
The popularity of the cloud should be noted, with researchers predicting that by year-end 2016, about 30% of enterprises will choose cloud-based services as their delivery option for new or refreshed user authentication implementations - up from about 10% today.
Mobile devices
Smartphones and mobile devices are playing a growing part in the authentication scenario. They are already widely used as authentication tokens; they function as fairly powerful computers and are an endpoint in themselves, so need protecting; and they can be used for biometric and contextual authentication.
Two authentication market leaders
Two of the leaders in Gartner’s Magic Quadrant for User Authentication* are VASCO and SafeNet. Looking at their product ranges gives us a more practical idea of what authentication methods are available today and how they are delivered.
VASCO
VASCO is a well-known name in authentication and has one of the widest ranges of authentication methods currently available. It is a leading supplier of strong authentication, e-signature solutions and services, specialising in Internet security applications and transactions.
The company is very strong in the financial sector, government, enterprises and e-commerce, with solutions for companies from SMEs up to the largest enterprises.
Gartner says VASCO has a “very strong position in this market” and calls the company “a very strong innovator.”
Authentication platforms include IDENTIKEY (server software), IDENTIKEY Virtual Appliance, IDENTIKEY Appliance (a hardware appliance), IDENTIKEY Federation Server (a higher end server appliance), DIGIPASS as a Service (private cloud service), MYDIGIPASS.COM (public cloud service) and VACMAN Controller (API-based authentication library).
IDENTIKEY Server
This is an authentication software suite for organisations of all sizes, with centralised user management, web-based administration, multi-platform support and enhanced reporting features. It verifies authentication requests and centrally administers user authentication policies.
IDENTIKEY Federation Server
This is a server appliance, providing a powerful identity and access management platform. It is used to validate user credentials across multiple applications and disparate networks. It is suitable for large corporations, governments, non-profit organisations and educational institutions
IDENTIKEY Appliance
This is a standalone authentication appliance that secures remote access to corporate networks and web-based applications. It can be used in an unlimited number of applications across a variety of fields, including online applications, banking applications, enterprise security and remote access.
DIGIPASS as a service.
This is a cloud-based authentication service using VASCO’s proprietary authentication technology. It’s aimed at ASPs (Application Service Providers) who can use it to secure their entire infrastructure.
VASCO offers a very wide range of authentication tokens, with the brand name DIGIPASS. There are three main types - - DIGIPASS Software, DIGIPASS Hardware and DIGIPASS Readers
DIGIPASS Software includes products such as DIGIPASS for Web, a browser-based, multi-factor authentication method that uses e-signatures and OTPs; DIGIPASS for Mobile Phone, a Java-based e-signature and OTP method that has no need for phone network coverage or additional hardware; and Virtual DIGIPASS, server-based authentication that uses an OTP and server-based e-signatures. It can provide a back-up service in the case of lost or forgotten tokens.
DIGIPASS hardware includes DIGIPASS Go-1, a one button, pin-protected device, with a time and event-based OTP and optional e-signature.
DIGIPASS readers include DIGIPASS 840 CV, a fully customisable, voice enabled keypad reader. This is smartcard based, for multiple applications, and uses e-signatures and OTPs.
SMEs
One solution for small businesses from VASCO is DIGIPASS Pack for Remote Authentication. This is an out-of-the-box solution which combines all necessary hardware and software to provide a high level of security to organisations with limited resources and budgets.
SAFENET
Gartner says that SafeNet “demonstrated a very sound market understanding, as well as very strong product strategy and innovation.” Gartner also says “SafeNet has a strong position in this market (customer numbers are in the highest tier)...”
SafeNet itself says it has a vision to make two-factor authentication universally available and that it provides inexpensive, easy-to-use, innovative solutions to a large range of clients, worldwide. Clients are in business, government and non-profit organisations.
SafeNet solutions include:
SafeNet Authentication Service
An SaaS (software-as-a service) based authentication platform. This solution comes in four types: a cloud-based service for enterprises, a cloud service for service providers, an onsite solution for enterprises, and an onsite solution for service providers.
It has been designed, says SafeNet, to make two-factor authentication easy to implement and manage. SafeNet says it provides the overall lowest total cost of ownership of any authentication solution.
Features include a comprehensive degree of automation to drastically reduce the cost of management, administration, tokens that do not expire and a comprehensive self-service portal that allows users to carry out many functions that would traditionally only have been resolved by the help desk.