1. Best practices to achieve
risk-appropriate authentication
Per Hägerö
CTO

2. #1 Security through Simplicity

3. 2

4. Define Risk-Appropriate Authentication
3

5. What are your options?
Something only you know (hopefully) Something you hold
KBA: Lexical Token: OTP
KBA: Graphical Token: PKI
Something your are Token: OOB
Biometrics: Biological
Biometrics: Behavioral
4

6. Risk levels (NIST SP 800-63-1)
High
Medium
Low
Minimal
5

7. Risk levels (NIST SP 800-63-1)
High
PKI
Medium OTP
OOB
Low
Lexical
Minimal
6

8. is it that easy?
7

9. NO! 8

10. 9

11. There are a number of needs and
constraints you need to consider
 Who are you authenticating?
 Where are they?
 What will they use it for?
 What end-points are they using?
 Are there any regulations?
 What is the available budget?
 What is the risk?
 Others?
10

12. all set?
11

13. not yet…
12

14. consider the aspect of identity proofing
13

15. ≤ 100 %
14

16. IDENTITY PROOFING
AUTHENTICATION
15

17. IDENTITY PROOFING
AUTHENTICATION
16

18. IDENTITY PROOFING
IDENTITY
ASSURANCE
AUTHENTICATION 17

19. 18

20. our approach…
19

21. Assurance
Adjacent needs Considerations
Ease-of-use
TCO
20

22. add additional protection with a layered
security architecture and adaptive access
control
21

23. The Nexus offering
PortWise Authentication Service
22

25. Customer Case:
 Verylarge bank (> 1 million )
 Requirement for a versatile authentication platform
 Other requirements:
– Web Service Management
– Integrated Virtual Directory
•
24

26. eBanking Framework
Management
OATH Cards Platform
OTP Software Policy Adaptive Access Authentication
Token Enforcement Point Manager Manager
Virtual Directory
Web Token
User User User
DB DB DB
25

27. 26

28. 27

29. 28

30. Risk-Appropriate Authentication is when
an authentication method that best fits the
use case is used, a method that is just right,
not too little or too much, at the right TCO
and that can use adaptive access controls
to determine risk and confidence levels
29

31. Questions and Answers
E-mail: per.hagero@nexussafe.com
Twitter: @hagero
Blog: perhagero.wordpress.com

32. ABBREVATIONS
 KBA – Knowledge-based Authentication
 OOB – Out of Band
 OTP – One Time Password
31