The Password is …

Merchants need new authentication tactics to protect themselves from an epidemic of data breaches

The problem is magnified by the fact that users tend to have the same password for many different accounts. Multiple studies show that upwards of 50 percent of individuals use the same password for all or most of their login accounts, including work, online merchant accounts, banking applications and social networking sites. This is dangerous for a number of reasons. Crime rings, for example, use social networking and other sites with relatively weak security to crack passwords. Sites without velocity checks to detect automated scripts or botnets are repeatedly exploited until valid credentials are discovered. Once passwords are ascertained on these weaker sites, the credentials can be used to gain access to numerous other sites. 

Armed with cracked, guessed or stolen login credentials, cybercriminals enter the front door so to speak. Using normal login procedures, hackers directly access user and even privileged system accounts to register fake accounts, make fraudulent purchases, steal credit or debit card data, download intellectual property and disrupt information systems.

Context-Based Authentication
The vast majority of authentication systems break because of one reason: they focus entirely on evaluating login credentials, usually passwords, and completely fail to detect or even look for imposters who have stolen but valid credentials.

It’s clear that a new approach is needed — one that adds authentication layers to increase trust when necessary, but doesn’t impact the experience of legitimate users. And, most importantly, the solution needs to look at the entire picture, not just login credentials. 

Fortunately, with the advent of context-based authentication, the entire set of circumstances that surround a login attempt can be evaluated. There are numerous indicators and techniques now available that detect with a high degree of accuracy when an imposter is attempting to gain access, even if he or she has valid credentials. Imposters are challenged and denied access, and legitimate users are allowed to connect without friction.

Related Content