The Re-evaluation of Authentication

Several articles and blogs about the recent Global Payments data breach have mentioned that the culprits were able to exploit some weak authentication methods to access the cardholder data.

Several articles and blogs about the recent Global Payments data breach have mentioned that the culprits were able to exploit some weak authentication methods to access the cardholder data. There is something those working in the security industry can do about that.

In recent years companies have made an enormous amount of data available online for remote employees, partners and even customers. The same basic authentication methods like username and password or knowledge based authentication aren’t enough to adequately protect the range of data that is currently available online, but it has been difficult for organizations to keep up as more applications and data are made available by different groups. I suspect that if organizations were to analyze all of the applications that they provide online access to and honestly evaluate the authentication methods in place, compared to the sensitivity of the data, there would be many areas of concern.

In the past, additional authentication security typically required expensive and cumbersome solutions that were difficult to maintain and support. This scenario has changed in recent years. There are now solutions that provide a variety of advanced authentication methods which can be managed centrally and applied appropriately depending on the security requirements. For example:

  • Some two-factor credentials can be implemented in a manner that is transparent to the end-user, their login experience can stay the same;

  • Risk-based authentication tools can transparently analyze the context of a login or transaction, evaluate the relative risk and then adjust the level of authentication required.

All of these options can be combined to create a policy-driven, layered security approach that is capable of protecting the wide range of data and access scenarios that a large organization must support in today’s online world.

The demands for online access at anytime, from anywhere and any device aren’t going away. We need to adopt a flexible, layered security solution that is intelligent enough to understand the sensitivity of the underlying data, the risk of the current transaction and then apply the appropriate level of authentication security with the least possible disruption to the end user. That’s how you securely enable business.


Written by

David Gormley

Published in


View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!


    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website.



  • king lear

    testing comment functionality, please do not publish this

  • Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.