Page 121 - Cyber Defense eMagazine August 2023

Token-based authentication offers another layer of security beyond password and other single-factor
authentication methods; giving only administrative users control over the actions needed for verification.
As hackers have grown to realize, passwords are often repeated or slightly changed across accounts
over time, making them easily accessible and, in some cases, putting multiple accounts at risk.

Adding token-based authentication is an important step in preventing fraud as it ensures that any user
must have access to an external account or device that will verify their identity through a uniquely-
generated, cryptographically- signed token or code. While this is a smart route to bolster security, this
approach can be further strengthened to enable passwordless access through the use of biometric
authentication.

New technology has enabled fraudsters to reroute text messages and easily gain access to a person’s
sensitive information via an account takeover or by remotely accessing their IoT devices. Biometric
authentication includes facial, fingerprint, iris, and voice biometric data that can be used to prove
someone’s identity.

For example, a person’s face is instantly compared to and matched with a database of existing users to
prevent one user from making multiple accounts. Today, behavioral biometric technology is being used
to detect behaviors like keystrokes or touchscreen behavior to continuously authenticate a user, leading
to even stronger authentication.

Unfortunately, today’s fraudsters have the benefit of new technologies like generative AI that make it
much easier to spoof someone’s biometric information. To effectively deter fraud, organizations need to
implement solutions with biometric algorithms that aren’t vulnerable to generative AI and injection attacks,
in addition to moving away from KBA and SMS authentication methods, which are becoming easier and
easier for bad actors to break through in our increasingly digital world.

Next-generation authentication like this provides a winning balance between security and convenience.
Deploying future-forward biometric and/or stateless authentication methods will ensure that the person
attempting to access an account or perform a transaction actually is who they say they are.

Identity Verification Driven by AI and Machine Learning

Current methods of identity fraud vary from creating fake IDs and passports to the use of more advanced,
hard-to-spot deepfake technology. Even the technology available to cybercriminals is advanced enough
to create replica ID cards that could fool the most experienced expert. A lot of solutions today only run
around ten tests on an identity document, thus requiring manual review from humans, while top-of-the-
line solutions using machine learning are able to run hundreds of tests, which decreases user friction
while increasing verification accuracy.

Utilizing AI and ML is necessary for accurate and secure ID verification because people can’t learn all of
the intricacies of identity documents. AI and ML offer a replacement for manual ID verification and can
process data much faster than humans, resulting in the ability to quickly spot suspicious patterns, while
also making sure visual aspects of the ID are in the right place. This would take much longer for a person

Cyber Defense eMagazine – August 2023 Edition 121
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.