Endpoint

1/11/2017
09:11 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Survey Points to Slight Rise in Adaptive Authentication Over 2FA

SecureAuth study reports a majority of IT decision makers and security pros have issues with two-factor authentication.

Security technologies continue to evolve as threats expand and some companies are turning to adaptive authentication as users report issues with two-factor authentication, according to a new study.

The study by SecureAuth found that 74% of respondents who use two-factor authentication admit that they receive complaints about the technology – and nearly 10 percent of users simply “hate it.”

These findings are in sharp contrast to a 2016 survey from SecureAuth in which 99% said two-factor authentication was the best way to protect an identity and access.

Amplitude Research conducted this year’s survey. The research group polled more than 300 IT decision makers and cybersecurity pros on industry concerns and perspectives on two-factor authentication.

“Users are responding to anything extra they have to carry,” says Craig Lund, SecureAuth’s CEO. “It’s what we call ‘no-friction’ in the log-in process. The log-in has to be very straightforward and as few extra steps as possible.”

With adaptive authentication, Lund says, instead of deploying a software or hardware token, all the security takes place in the background. Any remediation or alerts take place as-needed.

“If a user logs in from New York,” he says, “but an hour later logs in from Irvine, Calif., that sets off a red flag.” 

The survey reports that while 56% of organizations still use two-factor authentication in many instances, 37% are using adaptive authentication and an additional 16 percent are preparing to implement or expand the technology in the next 12 months. When looking at large organizations of 2,500 or more employees, usage of adaptive authentication rises to 41%.

Therein lies the rub, says Jon Oltsik, a senior principal analyst at the Enterprise Strategy Group who covers IT security.

While Oltsik agrees that adaptive authentication can be beneficial, it’s expensive and often difficult to deploy.

“Adaptive authentication is an enterprise type of application,” Oltsik says. “Given that more than 40% of the sampling in this survey is of companies with fewer than 500 employees, I think a technology such as adaptive authentication would be low down on their priority list. Companies of that size won’t be leading-edge consumers.”

However, the SecureAuth survey does point out that while only 24% of small businesses were likely to deploy adaptive authentication, 73% of survey respondents from small companies say they were concerned about the potential misuse of stolen credentials and identities to access their organization’s assets and information.

“Remember that small companies often can only afford one security professional,” adds Oltsik. “So they have to decide what that person is going to spend their time on.” 

Related Content:

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/18/2017 | 8:58:05 AM
User Behavior Analytics?
Interesting how the survey seems to point to a very short-lived "honeymoon period" for 2FA.

I'm interpreting adaptive authentication as another term for user behaviour analytics here. Is that right?

Looking for anomalies relative to a baseline of the specific devices the individual typically uses; the locations they typically access services from; the specific services they typically access. Even the particular way in which they make keystrokes on a keyboard, their gait, stance, posture or walk or heartbeat pattern, that kind of thing?

I know of a couple of companies using UBA with decent results.

Interested to hear more about real-world adoption rates.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17407
PUBLISHED: 2018-09-23
An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.
CVE-2018-17358
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a ...
CVE-2018-17359
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
CVE-2018-17360
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executa...
CVE-2018-17361
PUBLISHED: 2018-09-23
Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.