Endpoint

1/11/2017
09:11 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Survey Points to Slight Rise in Adaptive Authentication Over 2FA

SecureAuth study reports a majority of IT decision makers and security pros have issues with two-factor authentication.

Security technologies continue to evolve as threats expand and some companies are turning to adaptive authentication as users report issues with two-factor authentication, according to a new study.

The study by SecureAuth found that 74% of respondents who use two-factor authentication admit that they receive complaints about the technology – and nearly 10 percent of users simply “hate it.”

These findings are in sharp contrast to a 2016 survey from SecureAuth in which 99% said two-factor authentication was the best way to protect an identity and access.

Amplitude Research conducted this year’s survey. The research group polled more than 300 IT decision makers and cybersecurity pros on industry concerns and perspectives on two-factor authentication.

“Users are responding to anything extra they have to carry,” says Craig Lund, SecureAuth’s CEO. “It’s what we call ‘no-friction’ in the log-in process. The log-in has to be very straightforward and as few extra steps as possible.”

With adaptive authentication, Lund says, instead of deploying a software or hardware token, all the security takes place in the background. Any remediation or alerts take place as-needed.

“If a user logs in from New York,” he says, “but an hour later logs in from Irvine, Calif., that sets off a red flag.” 

The survey reports that while 56% of organizations still use two-factor authentication in many instances, 37% are using adaptive authentication and an additional 16 percent are preparing to implement or expand the technology in the next 12 months. When looking at large organizations of 2,500 or more employees, usage of adaptive authentication rises to 41%.

Therein lies the rub, says Jon Oltsik, a senior principal analyst at the Enterprise Strategy Group who covers IT security.

While Oltsik agrees that adaptive authentication can be beneficial, it’s expensive and often difficult to deploy.

“Adaptive authentication is an enterprise type of application,” Oltsik says. “Given that more than 40% of the sampling in this survey is of companies with fewer than 500 employees, I think a technology such as adaptive authentication would be low down on their priority list. Companies of that size won’t be leading-edge consumers.”

However, the SecureAuth survey does point out that while only 24% of small businesses were likely to deploy adaptive authentication, 73% of survey respondents from small companies say they were concerned about the potential misuse of stolen credentials and identities to access their organization’s assets and information.

“Remember that small companies often can only afford one security professional,” adds Oltsik. “So they have to decide what that person is going to spend their time on.” 

Related Content:

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/18/2017 | 8:58:05 AM
User Behavior Analytics?
Interesting how the survey seems to point to a very short-lived "honeymoon period" for 2FA.

I'm interpreting adaptive authentication as another term for user behaviour analytics here. Is that right?

Looking for anomalies relative to a baseline of the specific devices the individual typically uses; the locations they typically access services from; the specific services they typically access. Even the particular way in which they make keystrokes on a keyboard, their gait, stance, posture or walk or heartbeat pattern, that kind of thing?

I know of a couple of companies using UBA with decent results.

Interested to hear more about real-world adoption rates.
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14981
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005.
CVE-2018-14982
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004.
CVE-2018-15482
PUBLISHED: 2018-08-17
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006.
CVE-2018-15473
PUBLISHED: 2018-08-17
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2018-15471
PUBLISHED: 2018-08-17
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or c...