We've been discussing the authentication problem for the better part of two months, and now it's time to wrap things up. If you've gotten to this post through a link but haven't read the rest of the series, it starts with part 1 here.
Each of the 3 factors of authentication have serious issues when used individually. The challenge is that we need to log a person into a system or application in a way that reasonably assures the person is who they say they are and has rights to the system. And, perhaps most importantly, any method we use has to work well for people!
So, how do we find a solution?
The key is to think about the user and the use.
Showing posts with label adaptive. Show all posts
Showing posts with label adaptive. Show all posts
Tuesday, February 19, 2013
Tuesday, February 5, 2013
The 4th Factor? - 3 Factors of Fail (part 5)
Welcome to the next installment of my ramblings on authentication, 3 Factors of Fail. So far we have discussed the classic 3 factors of authentication in parts 1, 2, 3 and 4.
In recent years some additional authentication assurance methods have been grouped to form what some call the 4th factor of authentication. This is also called risk-based, location-based or adaptive authentication. It could also be called "somewhere you are" or "something you are doing".
The basis of this method is in establishing a rich profile of the user. This can include:
In recent years some additional authentication assurance methods have been grouped to form what some call the 4th factor of authentication. This is also called risk-based, location-based or adaptive authentication. It could also be called "somewhere you are" or "something you are doing".
The basis of this method is in establishing a rich profile of the user. This can include:
- the machine used for access;
- software used;
- time or day of accesses;
- IP address(es) used;
- what country the connection comes from, or;
- what actions the user attempts.
Subscribe to:
Posts (Atom)