Data security is broken. Here’s how to fix it.

Round and round it goes, where it stops, nobody knows.

Round and round it goes, where it stops, nobody knows. Few maxims better describe consumer driven IT, and the radical power shift it’s imposing on the enterprise. Consumers are taking control; dictating how, when, and where they connect to business data and applications.

And that’s a big problem, because the way we’ve handled data security for generations just doesn’t work in this new era. In fact, I would say it’s hopelessly broken. Today, identity management systems need to include people both inside and outside the organization. Identity and access rights of employees, partners, and customers must be equally well-managed and secured. Controlling access through a VPN, a corporate directory service, and a username and password pair is no longer sufficient.

Then there’s the problem of securing access points to data. Locking down consumer devices used to access data and applications has become impractical. Inside or outside the firewall, there’s no assurance that myriad devices can be kept secure. The number of device operating systems is multiplying, with varying levels of enterprise support, multiple update streams, and free apps that make it all too easy to bypass IT and tap enterprise resources.

There’s now malware that specifically exploits VPNs, and malware that targets smartphones and tablets. Mobile devices in the field can be (and are) lost or stolen. Local network attacks (called “wardriving“) and Bluetooth attacks (called “Bluesnarfing” or “Bluejacking”) eavesdrop on or otherwise gain access to data. And how often do your field employees, partners, and customers connect to the enterprise from untrusted locations, such as home networks, coffee shops, restaurants, airports, or libraries?

Frankly speaking, it’s impossible to keep a rapidly growing, quickly evolving, globally mobile device ecosystem perpetually locked down. Try if you must. But a better way to secure the consumer driven enterprise is to de-emphasize device lockdown in favor of stronger authentication.

While no authentication method should be considered failsafe, a flexible, layered approach (such as such as CA Advanced Authentication) is far more resistant to attack strategies old and new, including phishing, shoulder surfing, and device theft. Using versatile authentication techniques including strong authentication, device identification and risk analysis provides a practical solution to the complex environment that exists today and will continue into the future.

CA Advanced Authentication provides just such a layered approach using strong authentication, risk-based authentication and device identification. CA Strong Authentication is a lightweight approach with heavyweight benefits. It protects access to data better than simple logons, yet doesn’t impose an undue burden on users.

Traditionally, companies turned to two-factor authentication which is based on something the user knows (a password) and something the user has (a card or physical attribute). The combination of these credentials must be authenticated before a user is identified and given access to a network or application.

These credentials can be further strengthened with additional “knowledge-based” credentials such as those questions about your first pet’s name or high school mascot. The physical credential can be anything from a smartcard, SIM, or USB stick; to a touch pattern, iris scan, voice print, or facial recognition.

It’s likely you used two-factor authentication within the past 24 hours-but not when you logged on at work with your smartphone or tablet. Rather, when you withdrew money from your ATM you had your ATM card and you knew your PIN. It was convenient and more secure than the card or PIN alone. However, having a physical token is not practical in on online environment.

So how can you get the benefits of two-factor authentication for online access but make it simple and convenient for users? CA Strong Authentication provides a variety of authentication methods including a secure software credential that can be used as one of the factors eliminating the need to have a physical credential or a device reader for online access. Additionally, we provide a mobile app that runs on your phone that can generate a one-time-use password that can be used to authenticate to the online portal.

The next step in securing the consumer driven enterprise is to add the capability to analyze the risk associated with the device that is being used for remote access. One approach to this is device risk scoring, which determines whether or not a user can connect to enterprise data based on the device he is using. Risk scoring systems can maintain risk profiles for the user and every device that he uses to connect to the enterprise. These profiles record whether a device is one the system saw before, one the user used before, or one recognized but assigned to a different user.

A typical risk scoring system can identify the device, its location, and other metadata as a user is trying to authenticate to a system. CA Technologies addresses this problem using patent-pending technology to identify the device without using a cookie or tag on the device – so it’s non-intrusive. It profiles suspicious devices and blocks access if the risk score requires it based on policy.

Traditionally, risk scoring has only been used inside financial services organizations. It’s a technology the financial industry has long relied on for online and mobile banking applications. But consumer driven IT is making risk scoring relevant to the broad array of enterprise organizations. And that’s why you’re seeing CA Technologies bringing best practices we’ve learned from supporting financial services to the wider IT spectrum.

Consumer driven IT doesn’t have to rip through your organization like a tornado. You can avoid the storm, capitalize on the benefits and increase security profiles by simply adopting a layered authentication strategy.

Written by

Michael Denning

Mike leads the identity and access management business at CA Technologies. He is responsible for…

Published in


View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!


    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website.



  • king lear

    testing comment functionality, please do not publish this

  • Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.