Customer demands are increasing and changing at a rapid rate, forcing companies to adopt new technologies that scale with their business needs – especially security.
In the early days of online development, businesses had two choices for adopting a new service or solution: build it from scratch, or buy it from someone else.
The days of legacy “off the shelf” or “out of the box” technology are coming to an end, for good reason. Businesses can’t afford to rely on monolithic solutions that require expensive, extensive upgrades and customization services to accommodate new customer needs, especially when it comes to securing the accounts of your customers.
Thankfully, nearly anything a business could want is now available in the form of flexible building blocks: payments, contracts, communications, and infrastructure, and even security, are just a few of the areas that can be developed on accessible, scalable APIs. It’s no longer a question of “build or buy?”, but rather a matter of utilizing available tools to develop solutions that adapt to the challenges of protecting your users.
Consumers have countless profiles across several websites – banking, retail, social media – and they don’t want to have to jump through hoops just to use your service. The challenge for businesses today is delivering that amazing user experience while reliably securing those same accounts in the constantly evolving security landscape. API-driven two-factor authentication (2FA) can offset the weakness of passwords, while delighting your customers with a seamless experience that scales with your needs.
Passwords Aren’t Enough, and You Know It
There are a myriad of daily security threats: Malware, phishing attacks, and social engineering are just a few of the methods attackers employ to defraud users of their credentials. Even if users practiced good password hygiene, attackers can use a simple GPU to crack complicated passwords through brute force attacks within a single day. Unfortunately, that’s barely necessary anymore with the millions and millions of usernames and passwords that have been leaked or exposed.
Considering the recent, massive data breaches such as Target, Anthem, or the Office of Personnel Management, it’s likely your customers’ information is already out there. The average consumer will employ weak passwords that they reuse across several accounts. Worse, they probably won’t even change passwords regularly. It’s up to you, the business, to mitigate the ability of attackers to use that information against them, and your biggest challenge is finding a way to do that with the least friction possible.
Authentication Doesn’t Have to be Complicated
Previous efforts in enhancing authentication have focused on the addition of knowledge-based steps. These days, customers are often required to have their account information, mother’s maiden name, answers to random security questions, verbal passwords and more just to verify their identity. However, through the right deception and impersonation, nearly anyone can gain that information and pose as a valid user. Adding additional knowledge-based steps may make it slightly more difficult for an attacker to succeed, but forcing your customers to input all of that information each time they attempt to access their accounts is a terrible experience.
If you have a mobile or online offering, your users have something in common: they all have internet connected devices. Device-based, API-driven 2FA can reduce the log-in process to a simple text message or push notification.
Even tech giants like Yahoo are moving in this direction: in an ongoing effort to “kill the password”, Yahoo recently introduced the new Account Key feature to all of their users. The one flaw in this new 2FA experience is that it’s only available to Yahoo users. In an ideal world, every customer authentication process would be this smooth!
Fortunately, authentication services aren’t hard to find anymore, but when you research your options, keep the following in mind:
- Avoid services that are tied to specific hardware or operating systems. You don’t get to choose how your customers interact with your business, and you’ll need authentication that works with not just your current channels, but any that arise in the future.
- Look for scalable, affordable APIs that allow you to iterate and develop at your own pace. Up-front costs and heavy subscription models force you to estimate the impact on your customer base before you even start developing.
- Do not build 2FA from scratch. Security technologies cost more to build, support and maintain than any other technology competency, and the stakes are so much higher if you don’t do it right.
For more on what 2FA and other authentication services are available, read this recent piece in ComputerWorld, “Multi-factor authentication goes mainstream.”
The Cost of Inaction
Perhaps worse than getting security wrong, is doing nothing at all. On top of compromising your customers’ accounts, a single breach has lasting ramifications for your business:
- According to a 2015 global report from the Mobile Ecosystem Forum, lack of trust is the primary reason consumers do not download or use a mobile service.
- In a 2015 Deloitte US consumer trust survey, 83% of consumers reported being aware of recent data breaches, while 59% reported that knowledge of a breach would negatively impact a purchasing decision.
Consider this: while your business debates whether or how to introduce 2FA to your customers, criminal sites on the dark web are mandating its use for black market transactions. The individuals who are buying your customer’s already-breached information on the web are securing their ill-gotten gains with a technology that most companies have barely introduced as a feature.
In the Age of the Customer, Authentication is Key
Forrester Research believes we are already in a period of “customer-obsessed transformation*”, where “..customers expect consistent and high-value in-person and digital experiences. They don't care if building these experiences is hard or requires a complex, multifunction approach from across your business. They want immediate value and will go elsewhere if you can't provide it."
As you build the next generation of customer interaction for your business, just remember that the only way to truly know your customer is through reliable authentication.