Security leaders are conflicted over the use of continuous authentication protocol for the enterprise security
In the traditional methods, the most common authentication process is where users type in their credentials and passwords to login to a website or computer. They type in the password once; if it’s authenticated and allowed by the OS, then the particular session is unlocked.
In more secure practices, enterprises insist on secondary authentication element. It may be a one-time password, biometric sample, or physical equipment. The basic theme among all such authentication tools is that they must authenticate the users only once. Once the authentication is done, there are no checks or restrictions on gaining access to prevent unauthorized access.
CISOs say that when a user mistakenly leaves the computer unattended, the system is not equipped to know if the same employee who was authenticated initially is the one using it now. It could be an intruder who came across an unattended and unlocked system.
Security leaders want organizations to deploy strong security strategies that go beyond the initial authentication. This will ensure that data is not risked at the most commonly manipulated endpoint of network security.
Updated protocols like continuous authentication is a measure, which constantly checks the authenticity of the user for the entire time that they are logged into the session. Continuous authentication focuses on the largest risk factor in the computer security segment- users leaving behind unattended and unlocked devices. This protocol prevents tailgating. It refers to an unauthorized person gaining access to a restricted device or area without valid authentication. Piggybacking is also prevented in this method. It refers to authenticated users deliberately allowing an unauthorized person access to their session or system.
Read More: Successfully deploying an Identity-Centric Security Approach
Security leaders believe that the most effective continuous authentication protocol would involve various authentication measures to serve the best workflow for users and the top security level for administrators. This solution must be transparent to employees- and should be running continuously even without user input.
Advantages of continuous authentication compared to static authentication
Dynamic security over single logins
CISOs say that one-time authenticated sign-in is similar to checks at entrances. After that, no one is aware of their activities inside the campus. Static authentication solutions are not strong enough to constantly change practices like- shared accounts, personal laptops, multi-terminal access, etc. An effective authentication strategy will consider all human factors and environments as possible instead of relying on humans alone.
Reduced reliance on users
Security leaders say that serving robust security across the session and correctly identifying how to end sessions are the critical goals in the continuous authentication strategy. When user interaction is not required in continuous authentication, dependency on people is drastically reduced.
Read More: COVID-19 – Cyber Security Industry to Witness Growth
Reduced stress for admins
CISOs acknowledge that due to oversights in security measures by users, admins are under increased pressure during the pandemic. Often, employees will avoid all security-related measures and training like the plague and find ways to bypass the admin’s security, mostly to make processes easier for them. Using strong security solutions for continuous monitoring of users during the session’s complete duration is the best way to validate the highest number of security vectors possible.
Security leaders and C-suite leaders say that risk officers and administrators need to start considering beyond the traditional authentication methods. An effective continuous authentication strategy will expand the normal login process and decrease the threats in endpoint security by continuously securing all unattended points.
