Strong authentication use rising rapidly, study finds
January 24, 2019
Organizations are beginning to invest in stronger, phishing-resistant forms of authentication, according to "The State of Strong Authentication Report 2019," a new report developed by Javelin Strategy & Research and sponsored by the Fido Alliance.
The report finds that:
- The number of organizations using cryptographically backed strong authentication has tripled since 2017 for consumer authentication and increased by nearly 50 percent for enterprise authentication. This form of authentication is not susceptible to phishing, man-in-the-middle or other attacks targeting credentials — known vulnerabilities of passwords and one-time passwords.
- Nearly 70 percent of businesses say they face regulatory pressure to provide strong authentication for their customers due to the introduction of measures such as PSD2 in the EU and data protection regulations in some U.S. states.
- Two-thirds of businesses that use only passwords to authenticate employees believe this protection is "good enough" for the data they are protecting, though cybercriminals continue to target many types of consumer and business information.
- Adopting standards-based strong authentication solutions that employ cryptographic security can help organizations reduce the cost of keeping up with regulation, customer expectations and increasingly sophisticated fraud schemes.
- Javelin recommends moving from one-time passwords — which cybercriminals can compromise via social engineering, phone porting and malware — and adopting cryptographically backed strong authentication.
The report includes case studies from Google, Tradelink and Visa, all of which use Fido authentication to provide stronger protection for customer and employee accounts.
"The increase in strong authentication adoption makes sense given that while data breaches, phishing threats and regulatory pressures have risen, the financial and user experience costs associated with implementing strong authentication have decreased," Al Pascual, senior vice president and research director at Javelin said in a press release. "What's less encouraging is that we are finding that the holdouts believe passwords alone are sufficient security. These companies need to realize that even data they may think is low-risk can provide significant value to fraudsters and expose them to regulatory scrutiny. As such, they need to make plans to move to strong authentication now or they will find themselves an attractive target for cybercriminals."
Download the free 30-page report.
