1. risk-appropriate authentication –
a vision of tomorrow
Per Hägerö
CTO

2. risk-appropriate authentication?
1

3. 2

4. 3

5. What are your options?
Something only you know (hopefully) Something you hold
KBA: Lexical Token: OTP
KBA: Graphical Token: PKI
Something your are Token: OOB
Biometrics: Biological
Biometrics: Behavioral
4

6. Risk levels (NIST SP 800-63-1)
High
Medium
Low
Minimal
5

7. Risk levels (NIST SP 800-63-1)
High
PKI
Medium OTP
OOB
Low
Lexical
Minimal
6

8. is it that easy?
7

9. NO! 8

10. There are a number of needs and
constraints you need to consider
 Who are you authenticating?
 Where are they?
 What will they use it for?
 What end-points are they using?
 Are there any regulations?
 What is the available budget?
 What is the risk?
 Others?
9

11. all set?
10

12. not yet…
11

13. consider the aspect of identity proofing
12

14. ≤ 100 %
13

15. IDENTITY PROOFING
AUTHENTICATION
14

16. IDENTITY PROOFING
AUTHENTICATION
15

17. IDENTITY PROOFING
IDENTITY
ASSURANCE
AUTHENTICATION 16

18. Assurance
Adjacent needs Considerations
Ease-of-use
TCO
17

19. 18

20. trends
19

21. ease of use
20

22. less is more
21

23. user centric
22

24. authenticate once
23

25. layered approach
24

26. PRESENTATION TITLE
Whats up at Nexus Labs?
25