Page 110 - Cyber Defense eMagazine Annual RSA Edition for 2024

Anomalous Activity Monitoring and Adaptive Response:

Adaptive authentication, also known as risk-based authentication, is an intelligent system that
dynamically determines when to step up authentication and request additional factors to prove identity.
The system makes risk-based assessments for determining what level of authentication must be
provided, moving towards continuous assessment rather than a user simply authenticating at the start of
their session.

Adaptive authentication serves two primary objectives. First, it aims to enhance authentication security
by eliminating the “break once, run everywhere” scenario, where an attacker gains continuous account
access by overcoming a single authentication challenge. Secondly, it strikes a balance between security
and user experience. Since the strength of authentication is often associated with its duration or
complexity, adaptive authentication allows low-risk requests to be granted swiftly without burdening users
with excessive time-consuming processes.

Therefore, implement monitoring tools for detecting unusual MFA activity patterns, with real-time
mitigation response to potential threats.

When choosing a solution to help bolster your authentication and identity strategy, it’s important to
consider that some solutions support a level of FIDO authentication, but still use vulnerable methods as
fallbacks, which attackers are quick to take advantage of. These are neither fully passwordless or
phishing-resistant MFA.

Fully passwordless MFA based on FIDO standards meets the definition of phishing resistance set by
CISA and does not have any secrets that can be phished or intercepted. Truly phishing-resistant MFA
will support QR code scanning for the strongest protection against MFA fatigue attacks as it eliminates
the attack vector entirely.

About the Author

Bojan Simic is the Co-Founder, CEO and CTO of HYPR. Previously, he served as
an information security consultant for Fortune 500 enterprises in the financial and
insurance verticals conducting security architecture reviews, threat modeling, and
penetration testing. Bojan has a passion for deploying applied cryptography
implementations across security-critical software in both the public and private
sectors. His extensive experience in decentralized authentication and cryptography
has served as the underlying foundation for HYPR technology. Bojan also serves
as HYPR’s delegate to the FIDO Alliance board of directors, empowering the
alliance’s mission to rid the world of passwords. Follow him on LinkedIn and

and at our company website http://www.hypr.com/

110