Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/11/2017
09:11 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Survey Points to Slight Rise in Adaptive Authentication Over 2FA

SecureAuth study reports a majority of IT decision makers and security pros have issues with two-factor authentication.

Security technologies continue to evolve as threats expand and some companies are turning to adaptive authentication as users report issues with two-factor authentication, according to a new study.

The study by SecureAuth found that 74% of respondents who use two-factor authentication admit that they receive complaints about the technology – and nearly 10 percent of users simply “hate it.”

These findings are in sharp contrast to a 2016 survey from SecureAuth in which 99% said two-factor authentication was the best way to protect an identity and access.

Amplitude Research conducted this year’s survey. The research group polled more than 300 IT decision makers and cybersecurity pros on industry concerns and perspectives on two-factor authentication.

“Users are responding to anything extra they have to carry,” says Craig Lund, SecureAuth’s CEO. “It’s what we call ‘no-friction’ in the log-in process. The log-in has to be very straightforward and as few extra steps as possible.”

With adaptive authentication, Lund says, instead of deploying a software or hardware token, all the security takes place in the background. Any remediation or alerts take place as-needed.

“If a user logs in from New York,” he says, “but an hour later logs in from Irvine, Calif., that sets off a red flag.” 

The survey reports that while 56% of organizations still use two-factor authentication in many instances, 37% are using adaptive authentication and an additional 16 percent are preparing to implement or expand the technology in the next 12 months. When looking at large organizations of 2,500 or more employees, usage of adaptive authentication rises to 41%.

Therein lies the rub, says Jon Oltsik, a senior principal analyst at the Enterprise Strategy Group who covers IT security.

While Oltsik agrees that adaptive authentication can be beneficial, it’s expensive and often difficult to deploy.

“Adaptive authentication is an enterprise type of application,” Oltsik says. “Given that more than 40% of the sampling in this survey is of companies with fewer than 500 employees, I think a technology such as adaptive authentication would be low down on their priority list. Companies of that size won’t be leading-edge consumers.”

However, the SecureAuth survey does point out that while only 24% of small businesses were likely to deploy adaptive authentication, 73% of survey respondents from small companies say they were concerned about the potential misuse of stolen credentials and identities to access their organization’s assets and information.

“Remember that small companies often can only afford one security professional,” adds Oltsik. “So they have to decide what that person is going to spend their time on.” 

Related Content:

 

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/18/2017 | 8:58:05 AM
User Behavior Analytics?
Interesting how the survey seems to point to a very short-lived "honeymoon period" for 2FA.

I'm interpreting adaptive authentication as another term for user behaviour analytics here. Is that right?

Looking for anomalies relative to a baseline of the specific devices the individual typically uses; the locations they typically access services from; the specific services they typically access. Even the particular way in which they make keystrokes on a keyboard, their gait, stance, posture or walk or heartbeat pattern, that kind of thing?

I know of a couple of companies using UBA with decent results.

Interested to hear more about real-world adoption rates.
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.