|
Risk-based authentication uses multiple factors to score the likelihood that a user is, in fact, who he or she claims to be online. To establish a confidence level regarding the user’s digital identity, a combination of observed and requested factors can be used.
Risk engines collect observed factor information – keystroke dynamics, device characteristics, IP address, and more -- use rules to score that information, create a confidence rating, and then provide access based on the confidence or lack of risk.
Risk-based authentication has been widely adopted in the financial services industry and is now gaining acceptance in other industries as a means for preventing online fraud. Unlike other methods, risk-based assessment can occur continuously: at initial login; at each interaction during a secure session; as well as during transactions specified as high-risk transactions.
Cost-effective and Brand-friendly
The key advantage of risk-based authentication is that no additional hardware or desktop software is required to provide a cost effective solution. More advanced risk-based authentication solutions also preserve the brand experience by using only observed factors like keystroke dynamics to make the approach seamless or invisible to the end user.
The effectiveness of risk-based authentication based on observed factors is comparable to that of hardware, certificate, or desktop software-based authentication approaches, but risk-based authentication is far less expensive to implement and manage.
Dynamic, Effective and Powerful
Risk engines can be run by static or dynamic rules. Static rules engines rely on a fraud team to develop statistical models of fraudulent access and then create rules for detecting fraudsters. Dynamic rules engines build a behavioral profile of each user and score actions against previously verified behavior.
Dynamic rules engines have the advantage, since they are constantly adapting to user behaviors, and can detect patterns that a static rules engine might miss. For example, a login request originating from a foreign country might be assessed and treated differently for a known frequent traveler than for a user who always logs in from home.
|
