People today are more connected, digitally, than ever before. Digitalization and technological advancements have fueled the adoption of connected devices, which are expected to reach nearly 31 billion units by 2024.
That increase in prevalence, in turn, has led to a 62% increase in cyberattacks worldwide – and a 158% increase in cyberattacks in North America alone – over the last two years, prompting an increasing number of organizations to implement authentication solutions.
How the Authentication Process Works
An authentication process is a tool for keeping unauthorized users from accessing sensitive information and systems. It checks to see whether a user’s credentials match the credentials in a database of authorized users or in a data authentication server.
There are a variety of authentication methods in use today, and they fall into three general categories:
- Knowledge factors: Something that’s known only to the user, such as a username and password.
- Possession factors: Something the user has in his or her possession, like a smart card, a wireless tag or a security token.
- Inherence factors: Something the user is, like a biometric characteristic such as a voice or iris pattern. Biometric authentication is increasing in everyday use, for example a smartphone lock screen that asks for the user’s fingerprint.
Factors to Consider When Choosing an Authentication Process
Organizations today need to act proactively to identity and mitigate the risk of a cyberattack while meeting customer expectations and the needs of the business. Among the considerations when selecting an authentication process:
- Customer effort required: Customers today demand a frictionless experience; they have little patience for a long and tedious authentication process.
- Operational efficiency: The cyberthreat landscape is constantly evolving, and these shifting fraud patterns ultimately require organizations to invest in additional resources to keep systems secure. Consider whether the authentication process you are implementing allows you to contain more calls in self-service or reduce AHT.
- Real-time fraud prevention: Authentication processes can be used to expose fraudsters and block them in real time, for example by scanning watchlists against the caller's voice and call characteristics in the beginning of each call to identify suspected fraud.
- A high level of security: In addition to ease of use, customers today are concerned about security; in fact, a recent survey found that security is the most important factor for the majority of consumers. More than one-third (34%) of consumers surveyed said data protection and potential loss from fraud was important, while 32% of consumers said ensuring the security of financial data was important. The survey also uncovered that data loss and prevention of data access was more important than the speed of online transaction (21%) or the ease of the customer checkout experience (17%).
How to Make the Authentication Process More Secure
Given the importance placed on security by both businesses and the consumers they serve, organizations need to take steps to strengthen their existing authentication processes. The level of security precautions you implement should be guided in part by your risk tolerance as well as the regulations, if any, that affect your industry; a company whose customers largely engage in low-risk activities may decide that it is comfortable with a lower level of security than a company that handles sensitive financial information or health data, for example. Among the actions you can consider to make the authentication process more secure:
- Teach users about password security: Help users understand how phishing attempts work and how they can protect themselves and their passwords.
- Encourage stronger passwords: Educate users about the importance of creating a strong, unique passwords for each individual website and system; this is where password managers are useful in helping users keep track of logins. It’s important that the password be unique because cybercriminals work under the assumption that many users re-use passwords, and they often succeed by retrieving passwords directly from data breaches and using them to access other systems. Some tips to help users create strong passwords include:
- Selecting a long password, at least 12-16 characters in length.
- Avoiding common words or phrases, like 12345, password or qwerty. In short, if it’s on the list of the world’s 100 worst passwords, it should be avoided.
- Incorporating alphanumeric (both letters and numbers) and special characters (e.g., `! @#$%^&*).
- Implement single sign-on (SSO) authentication: Enable users to securely authenticate access to multiple applications or websites using a single set of credentials. With SSO, a certificate or authentication token is exchanged between an app or business system and the SSO provider. For example, many people leverage social SSO, using their Google, LinkedIn or Facebook credentials to log in to a third-party application. SSO authentication is convenient for users because it reduces the number of passwords a user needs to remember, but that convenience introduces the risk that a cyberattacker who gains access to the user’s credentials has access to all systems the user has access to.
- Use biometric authentication: By its very nature, biometric authentication is one of the most secure type available. Because it depends on the user’s biology (e.g., fingerprint, voice, retina or facial structure), the chances of hacking are very low. Voice biometrics, for example, can be used in the contact center to automatically verify a caller’s claimed identity within the first few seconds of a call through natural conversation with an agent.
- Enable multi-factor authentication: Multi-factor combines two or more authentication processes, for example by requiring a username and password in addition to a security token, a smart card, a PIN or biometric authentication.
In an era of large-scale data breaches, authentication has become a business imperative – and one that must become increasingly more secure as the threats against your business systems and data evolve. Learn more about consumer authentication initiatives in the contact center in our recent blog. You can also find out more about how NICE enables seamless, multi-factor authentication across channels with Real-Time Authentication.