df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

IAM starts at the login box but impacts security, analytics, and user experience

Identity and Access Management (IAM) is the branch of IT concerned with verifying users' identity and controlling their access to digital resources. Or, as [Gartner defines it](https://www.gartner.com/en/information-technology/glossary/identity-and-access-management-iam): "IAM is the discipline that enables the right individuals to access the right resources at the right times for the right reasons."

<iframe width="560" height="315" src="https://www.youtube.com/embed/IKxigcbhsGk" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## IAM Key Concepts: Authentication vs. Authorization

As the name indicates, IAM concerns both verifying users' identity (authentication) and granting them access to data based on that identity (authorization). These concepts are interrelated but not interchangeable, and understanding each is critical to grasp the larger meaning of IAM.

**Authentication refers to the methods you use to determine that someone is who they claim to be.** The classic authentication method is the username-password combination. However, using passwords alone for authentication is increasingly regarded as insecure since passwords are easy for hackers to guess or steal via [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/).

Today's gold standard for verifying identity is [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication), which supplements passwords with authentication methods that are harder to fake, such as a biometric scan or a code sent to a user's personal device.

![MFA](https://images.ctfassets.net/23aumh6u8s0i/7ujWt3YR4Lc2D6MlbcibdZ/a5a02d1d95abd9014ab6d30d86dc5bb9/mfa-iam)

For a real-world metaphor, imagine going to a nightclub where you're on the list. The bouncer checks your ID to make sure you're really you (authentication). Then the bouncer lets you in and tells you that there's an asterisk next to your name, which means you're allowed into the VIP section (authorization).

**Authorization is the allocation or delegation of permissions to a particular individual or type of user.** For example, in the nightclub, a regular patron has access to the dance floor, a VIP is allowed behind the velvet ropes, but only the owner can get into the back office with the safe.

A modern IAM platform lets admins control authorization from a central user dashboard and via APIs, saving time and preventing security incidents. For instance, you could log into your IAM dashboard and grant a specific freelancer the ability to edit their own pieces. Likewise, if an administrator leaves the company, you can revoke access, so they don't walk away with valuable intellectual property.

![Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7BQhEA3AimOi3dxgnAJv2h/2b4b1d707578bbb9f4fbf6e3160f610d/dashboard-iam)

## Types of IAM

Most organizations have multiple classes of users with different identity needs: their workforce, their business partners, and their customers. Even if you're using the same IAM platform for all three, you'll need to take a different approach for each.

### Workforce identity

The average business makes use of a wide variety of applications. Say you buy and provision to your employees (like Slack or WordPress) and some you build in-house. In either case, you need a [workforce IAM approach](https://auth0.com/b2e-identity-management-for-employees/) that integrates with all these disparate apps. As in our earlier example of the library, you use this to allocate permissions based on roles or individual identities.

### Customer Identity (CIAM)

[Customer identity and access management (CIAM)](https://auth0.com/b2c-customer-identity-management/) is its own branch of IAM and is used to control access to your external applications. You're most likely to use social logins here and generally focus on reducing friction (while still implementing appropriate security). [CIAM](https://auth0.com/blog/what-is-ciam/) is rapidly expanding as people log in on more devices, like smart TVs and wearables. 

A CIAM platform is concerned not just with the end user's login experience, but with gathering information about them into a data-rich identity profile. The greater your understanding of your users, the greater your ability to provide value for them. 

With this valuable data comes a huge responsibility: of obeying data privacy laws regarding data collection and storage, and sensitive data against breaches. Given that, a major (though often invisible) element of CIAM is controlling access to customer data by your own employees and third parties.

### B2B identity

IAM for enterprise customers might be the most specialized branch of identity management. It's also one of the most complex since large enterprises operate on different back-end technology stacks. 

Custom-made identity solutions often falter here and struggle to scale when onboarding multiple large customers. That's why startups often switch to third-party IAM platforms when they begin to move upmarket, so they can quickly federate identity using any provider and on any technology stack.

## IAM Tools

An old-fashioned approach to IAM might be as simple as a login box and some basic, role-based permissions. For instance, a public library with a digital card catalog just needs to let patrons log in and ensure they can't access functions reserved for the librarians.

But that limited understanding of IAM is ill-suited to a post-digitization world. These days, most organizations utilize a vast number of applications, and personal data can be both a valuable asset and a dangerous legal liability. If that same public library wants to let patrons log into all nearby branches with the same credentials, interface with local school software to connect students with books, and simultaneously protect those students' data, they'll need a much broader set of tools than a simple login box.

Today, most IAM platforms provide some combination of the following tools and features, albeit with varying levels of customizability and extensibility.

### Single Sign-On (SSO)

[SSO](https://auth0.com/docs/sso/current) is an IAM tool that enables a user to log into one of an organization's properties and automatically be logged into a designated set of other properties. For example, when you log into Google, you're automatically logged into your Gmail and YouTube accounts. For users, SSO reduces friction since they don't have to keep track of different credentials for every application. For organizations, SSO helps in collecting valuable insights about user behavior and preferences since it tracks them as they move from one application to another, connected by a single login.

### Federated Identity

While SSO lets users log into different properties or brands owned by a single organization, federated identity does the same thing across multiple organizations.

Most people are familiar with federated identity through [social login](https://auth0.com/learn/social-login/), in which you can use your Google, Facebook, or Apple ID to log into a wide range of apps. Federation is built on trust, so when you order from a food delivery app with your Apple ID, you're not ordering from Apple but indicating that the app trusts Apple enough to take their word that you are who you claim to be.

For [B2B federation](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/), there are a different set of enterprise connections, such as Active Directory, Azure, SAML, LDAP, and ADFS.

![B2B Federation](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation is often a challenge because different organizations use different technology stacks and enterprise connections. But a robust IAM solution such as Auth0 integrates across numerous providers, saving companies from having to code complex workarounds to make different back ends communicate with one another.

### Multi-factor authentication (MFA)

As we mentioned earlier, implementing MFA is crucial to protect your organization's data from malicious intrusions, and virtually every IAM platform offers some form of MFA. However, it's equally crucial to customize MFA with the appropriate level of security. IN B2C contexts, you need to consider UX and try not to create unnecessary friction for users who don't want to be subjected to heightened scrutiny every time they log in. For workforce IAM, you may want more stringent MFA, since the consequences of an unauthorized party gaining access to your private network can be so devastating.

A modern IAM solution will allow you to implement MFA only when it's needed. This can be accomplished through [step-up authentication or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) in which users only trigger MFA if they're trying to access sensitive data or their behavior is flagged as risky.

### Anomaly detection

In the past few years, identity has become the preferred gateway for hackers to break into systems. Brute force attacks, credential stuffing attacks, and even highly targeted phishing campaigns are all attempts by hackers to break in through a company's front door: the login box. 

These attacks [can be devastating](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/), leading to stolen data, legal fallout, and huge spikes in traffic that crash applications. A cutting-edge IAM solution is designed to get in front of those issues through anomaly detection.

There are multiple ways IAM systems can help detect and mitigate malicious attacks. IAM solutions detect attacks by monitoring signals such as the velocity of traffic, detection of login patterns that differ from a user's routine (such as location and browser), use of a breached password, or use of devices and IP addresses with a poor reputation.

In Auth0's case, we use two primary tools for anomaly detection: [brute-force protection and breached password detection](https://auth0.com/docs/anomaly-detection).

Brute-force protection stops users from logging in from the same IP address after a certain number of failed attempts, preventing botnet attacks from causing outages.

Breached password protection is designed to monitor data breaches in which credentials have been compromised and warn both companies and individuals. Auth0's breached password protection lets users customize how they respond to such an event. Customers can notify users when their passwords have been stolen, and if they choose, prevent users from logging in until they change passwords.

## The Benefits of Third-Party IAM

For users, the most visible element of IAM is the login box, but IAM's relationship to security and data management goes far beyond just usernames and passwords. Because of this, developers and IT teams are faced with a choice: build IAM functions in-house or outsource to third-party IAM platforms. 

While there are advantages to each approach, a sophisticated IAM platform links identity across applications, guards against data breaches, and is a valuable source of analytics. Think of it like the circulatory system for all of an organization's digital resources &mdash; just beneath the surface, interwoven through every application.

Many companies chose to build their IAM solution in-house in years past, but these days, more and more are outsourcing their identity and access management needs to third parties. A [2020 Auth0 survey](https://auth0.com/resources/whitepapers/state-app-assembly-2020) of IT professionals found that 58% currently outsource authentication when building applications. This trend has given rise to a new subset of Software as a Service (SaaS), known as [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/).

The reasons organizations increasingly choose to buy an IAM platform, rather than attempt to build it, are complex and vary depending on a company's size and needs.

### Cost and time savings

Building and maintaining an in-house identity solution is a challenge for companies of any size and particularly for startups with limited resources. Auth0 customers frequently report that custom IAM solutions can quickly become full-time jobs for multiple developers, representing a fundamental distraction from their core business proposition.

### Adaptability and extensibility

Large enterprises often transition to an external IAM provider because their in-house solution is riddled with legacy code and doesn't integrate with a wide range of applications. In-house solutions are static and closed to outsiders, and repairing one may be more of a headache than it's worth. Instead, enterprises may find more value outsourcing to a platform designed to interface with other systems and add new capabilities.

This confers major business advantages. For instance, an extensible IAM solution is crucial in [post-merger integration](https://auth0.com/resources/whitepapers/Managing-Identitity-10-steps-PMI), helping migrate user identities from multiple sources into a single directory.

### Security and legal compliance

In the past few years, personal data has become a hot-button issue, with numerous high-profile data breaches and the passage of data privacy regulations around the world. Laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) demand that businesses exercise greater control over who can access their user data and also require businesses to share that data with users upon request.

There are high costs for failing to comply with data privacy laws, and as more laws are passed, adjusting an IAM solution for each one can easily be costly. Proprietary systems often have hidden vulnerabilities and may not conform to an industry's security best practices. Outsourcing to a trusted third-party IAM platform can offload some of the burdens of compliance and ensure that security measures evolve in keeping with current best practices.

## IAM: Central to Your Business, Crucial to Your Future

As you've seen, IAM is an umbrella term that encompasses multiple tools, functions, and even philosophies about how organizations manage access and identity within their systems. Many executives who aren't used to devoting much thought to IAM are surprised to learn how closely it's tied to security, user experience, and business outcomes. However, even as IAM evolves to be more important and complex, the technology for managing it is evolving to be more comprehensive and intuitive. 

If you're interested in learning more about how Auth0's IAM platform can serve your identity needs, please [reach out to our dedicated team](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What is IAM?

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The essential tools for managing user identity and how they impact your bottom line

Customer Identity and Access Management (CIAM) is how companies give their end users access to their digital properties as well as how they govern, collect, analyze, and securely store data for those users.

CIAM sits at the intersection of security, customer experience, and analytics. Providing an easy, frictionless way for users to onboard and log in is critical for driving conversions and building customer loyalty. Protecting sensitive data from malicious intrusion and taking steps to prevent data breaches is central to a sound security policy and compliance with data privacy laws. And compiling user data into a single source of truth is essential to understanding your customers.

Given CIAM’s complexity and dynamism, many organizations choose to engage a third-party [Identity-as-a-Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider rather than build a solution in-house.

Below, we’ll discuss the elements of a modern CIAM solution and how your company’s approach to customer identity can impact top-line revenue as well as mediate bottom-line security risk.

<iframe width="560" height="315"" src="https://www.youtube.com/embed/belLEwjr9zQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Essential Elements of CIAM

Organizations need Identity and Access Management (IAM) solutions for several classes of end-users: employees, enterprise customers, and customers. But each type of user requires a different balance of security and user experience (UX). That’s why CIAM solutions provide a unique set of features distinct from B2B or workforce identity solutions.

Here are four features that form the bedrock of modern CIAM solutions. No two CIAM solutions offer exactly the features in the same way, but if you’re purchasing a CIAM platform, it should include the following:

### Scalability

Unlike workforce identity solutions that support thousands of employees and vendors who require fairly static access to a pre-assigned list of applications, CIAM has to scale to millions of users — often in response to short-term events like peak holiday seasons or major sporting events.

Although not traditionally described as a software “feature,” scalability is a unique element of CIAM that requires third-party, cloud-scale stability.

### Single sign-on
Single Sign-On (SSO) allows users to log in to one application and automatically be logged into a set of other applications. The most widely known SSO example is Google G Suite, where logging into your Gmail means you’re automatically logged into YouTube, Google Drive, and other Google platforms.

SSO is a basic element of federated identity, and there are SSO options for B2B and workforce IAM solutions. The type of SSO that’s specifically designed for end-users is [social login](https://auth0.com/learn/social-login/), which allows users to verify their identity with their credentials from a separate provider, like Facebook, Google, or Apple.

![Enabling Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3q11XLTm7JG97Zui0NdS83/69c34978d5b60a9fbfaceb42459b0334/enabling-social-connections)

Social logins greatly simplify the registration process for users, which can lead to increased conversions and fewer customers abandoning their shopping carts because they got tired of filling out a form. (More on the advantages of SSO later.)

### Multi-factor authentication

Multi-Factor Authentication (MFA) is a more secure means of authenticating user identity than the traditional username/password combination. Passwords are distressingly easy for hackers to steal or guess, so MFA demands an extra credential for users to prove their identity. This could take the form of a one-time PIN sent to the user’s mobile device, an email, or a biometric credential like a fingerprint or face recognition. Auth0 is even releasing a feature in which users can receive a phone call with a voice message of their one-time PIN.

![MFA Voice Recognition 1](https://images.ctfassets.net/23aumh6u8s0i/4uESmkHbV2FMThLWcAvqsi/90e5f72b2eca085e8bae37d60179c2b6/mfa-voice-recognition-1)

![MFA Voice Recognition 2](https://images.ctfassets.net/23aumh6u8s0i/3BLSbVxpLMYbflpxDk3FSb/2c52471683ca8c9b763ca4138504f829/mfa-voice-recognition-2)

![MFA Voice Recognition 3](https://images.ctfassets.net/23aumh6u8s0i/3F0G4n8bUa3BIAUQg7xuHm/7a770f40b2b958f1001a1c932408d119/mfa-voice-recognition-3)

MFA is increasingly regarded as a basic requirement for security, and data privacy laws are beginning to explicitly demand it. However, it’s critical to implement MFA for end-users in a way that doesn’t introduce unnecessary friction. MFA should only be triggered based on the assessed risk, such as when a customer signs in with a new device or makes a suspicious transaction. That’s another reason why it’s critical to have the deep insight into your customers that CIAM provides. So you can assess in context when a transaction requires a higher level of authentication.

### Centralized user management

Your insights into your users can be a major competitive advantage, but only if your data is organized, accessible, and accurate. A CIAM solution helps achieve the goal of centralized, data-rich customer profiles that function as a single source of truth about users. That’s because a CIAM solution is essentially an API that mediates between different applications and components, compiling heterogeneous data in one place.

Centralized user management eliminates data silos and duplicate data. Everything you know about a user is together in one place from which admins can quickly grant and revoke permissions. This single view of customers is an obvious advantage for analytics, but it also helps companies meet the reporting requirements of data privacy laws because all profile data is accessible and portable. Knowledge about the user is also critical for building more personalized experiences, which drives higher retention rates.

![Centralized User Management](https://images.ctfassets.net/23aumh6u8s0i/okSReaVDL4OSDzKC20Kiv/db01bde2e4bfef2b6c5eb85f8b7000fa/logins)

## How CIAM Impacts Business

Now that we’ve gone over the fundamental elements of CIAM, let’s talk about how those elements impact your company’s day-to-day operations and your all-important bottom line.

## CIAM Is Central to Data Security

Customer data can be your company’s greatest asset — unless it falls into the wrong hands. A robust CIAM solution has security features to protect against fraud, hacks, and misused data on multiple fronts.

In recent years, the login box has become the front line for fending off intruders. Hackers use [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) to steal or guess user credentials and impersonate legitimate users at the login box. One of the most damaging forms of broken authentication attacks is [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/), in which hackers use passwords stolen in one breach to break into other sites. This method works given people’s tendencies to reuse passwords. There are currently billions of stolen passwords being passed around the dark web. Credential stuffing attacks alone cost businesses an average of $4 million a year, according to a 2019 [study from the Ponemon Institute](https://www.information-age.com/credential-stuffing-123482099/).

The best defense against credential stuffing and other authentication-based attacks is a CIAM solution with MFA and brute force protection. Brute force protection stops hackers from flooding your application with login attempts and crashing your site. Meanwhile, MFA ensures that a stolen credential won’t give hackers automatic access to your users’ accounts.

It’s important to note that the amount of damage hackers can do with customer credentials is limited, since they don’t have access to back-end systems. But these attacks can still damage your customer relationships and lead to negative headlines, as in the case of the [Disney+ attack](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/).

CIAM systems also help protect your customer data from back-end mischief in the event of a data breach or hack. CIAM solutions govern how you encrypt and anonymize personal data, so it’s useless to data thieves. It’s essential to choose a CIAM system that uses the latest encryption protocols, however, or your databases of sensitive data might as well be written in plain text. Finally, CIAM systems track who within your organization is accessing customer data and alerts admins to suspicious activity. That way, neither an employee nor a bad actor can walk away with your most valuable and sensitive asset: your customer data.

**How it affects your bottom line? Cost of data breaches.**
A [2019 Ponemon study](https://www.ibm.com/security/data-breach?cm_mmc=OSocial_Blog-_-Security_Optimize+the+Security+Program-_-WW_WW-_-CODB2019Blog_ov70891&cm_mmca1=000000NJ&cm_mmca2=10000253) found that the average data breach costs businesses $3.92 million. Businesses who don’t want to budget for that should budget for a modern CIAM solution instead.

## CIAM Helps Manage Data Privacy Law Compliance

A new crop of data privacy laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) is fundamentally rewriting the rules for how organizations collect, store, and share personal data (PD). Meeting these legal obligations means managing your approach to CIAM.

To begin with, centralized user management is essential in fulfilling the reporting and erasure requirements of data privacy laws. Under GDPR and CCPA, organizations must provide users, upon request, with copies of their data along with a record of how that data is being used.

Then there’s the issue of MFA. GDPR, CCPA, and New York’s SHIELD Act fall short of explicitly demanding MFA. Still, they require “reasonable” or “appropriate” security measures, and both [legal and security experts](https://www.natlawreview.com/article/new-york-shield-act-faqs) agree that this means MFA. GDPR enforcement has supported this idea: multiple organizations have been [slapped with fines](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/) for failing to implement MFA.

Data privacy laws are all about controlling who can access PD, so encrypting customer data and controlling access to it are baseline requirements. A CIAM solution needs to provide all of these elements, as well as tailoring data collection and consent management practices to the relevant laws.

**How it affects your bottom line? Cost of regulatory fines.**
As of May 2020, EU states had issued over [€153 million in fines](https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/) to large and small organizations for non-compliance with GDPR. In November, Californians will vote on the California Privacy Rights and Enforcement Act (CPREA), the so-called “CCPA 2.0.” As the name suggests, the new version will feature a greater emphasis on enforcement. With new laws being passed all the time, the cost of non-compliance can add up quickly.

## CIAM Is a Business Enabler Through Customer Experience

A good CIAM solution is the difference between showing up at a crowded restaurant and being told there’s a 20-minute wait and being escorted straight to your table while the bartender mixes your favorite drink. With the right approach to CIAM, you can give your customers easy login and offer them services based on a nuanced understanding of their needs.

Businesses live and die by their conversion rates, and it’s tough out there. In 2019, the [average global website conversion rate](https://www.invespcro.com/blog/the-average-website-conversion-rate-by-industry/) was 2.58%, which is actually down from 3.42% in 2014. Clearly, today’s customers have no patience for filling out frustrating registration forms. If you use social login, your users get a friction-free registration experience without having to remember another password.

Meanwhile, your company gets the benefit of shared knowledge with that social media provider, so you automatically know your customer’s location, timezone, language, and other details to guide upsell recommendations.

**How it affects your top line? Higher conversions and retention, less frustration.**
[Studies have shown](https://blog.hubspot.com/blog/tabid/6307/bid/6746/Which-Types-of-Form-Fields-Lower-Landing-Page-Conversions.aspx) that reducing the number of form fields increases conversion rates. With social logins, you can eliminate the form altogether and enable one-click signup. Plus, when users don’t have their own unique password for your business, you save help desk time. [Gartner research](https://www.infosecurity-magazine.com/webinars/password-management-getting/) says between half and a quarter of help desk calls are for password resets. A North American healthcare organization told us it spends approximately $160 to $170 per employee per year on password-related issues alone.

## CIAM: A Holistic Approach to Customer Identity Management

As we’ve shown, CIAM plays an increasingly central role in how companies create their digital identities and manage their customer relationships. Given that, companies are allocating more resources to their access management solutions, either from day one or as part of a larger digital transformation.

To learn more about how CIAM can help provide enhanced data protection and seamless customer experience, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />


What is CIAM?

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what multi-factor authentication is and different methods for implementing MFA.


Before you can learn about multi-factor authentication, you must understand authentication itself. Authentication, simply put, is the process of **verifying that someone is who they say they are**.

When you want to sign in to your account on a website, the website must first make sure you're the owner of that account. How do they do that? They ask you for something that only you should know. Typically, this is the **username and password** that you set up when you created the account. Great! You were the one who set it up, so there's no way anyone else could have your password, right?

It turns out that someone providing the correct username and password to access a resource doesn't necessarily prove that they are who they say they are. User credential breaches have become much more prevalent in recent years, so there's a good chance that some of your username and password combinations have been involved in a breach. This means that relying only on a username and password to identify someone isn't a great practice.

This is where multi-factor authentication comes into play.

## What is Multi-factor Authentication

Multi-factor authentication (MFA) provides a method to verify a user's identity by requiring them to provide **more than one piece of identifying information**.

You have most likely encountered multi-factor authentication on some of your favorite websites already. For example, when you sign in to your banking account, you may get a screen requesting that you enter the code that was emailed to you. Once you enter this code, you're then able to access your bank account. This is an example of MFA in action!

Providing a username and password coupled with a code sent to your email is one form of MFA, but there are several other options you have for implementing MFA. Let's look at some of those now.

## Types of Multi-factor Authentication

The category that you use to identify a user is called an **authentication factor**. In general, these identification methods fall into three authentication factor categories:

**Something you know** &mdash; Something you know, such as a password, PIN, personal information like mother's maiden name, etc.

**Something you have** &mdash; A physical item you have, such as a cell phone or a card.

**Something you are** &mdash; Biometric data, such as fingerprint, retina scan, etc.

To implement multi-factor authentication, you need to cover at least two of these categories.

A common scenario would be requiring a user to sign in with their username and password. This covers the "**something you know**" category. After providing their username and password, they'd receive a text to their cell phone with a short code called a one-time password (OTP). This covers the "**something you have**" category. They'll be required to type this code into the website, and if correct, then they'll be authenticated.

<AmpContent>
![One-time password screen](https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password)

</AmpContent>

<NonAmpContent>
<p>
<img class="img-responsive" src="https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password" alt="one-time password screen" style="width:50%"/>
</p>
</NonAmpContent>

In this scenario, even if an attacker knows the user's password, *it isn't enough*. They'll have to also gain access to the user's phone to provide the one-time password.

### One-time passwords

In the scenario above, the application sent the user a code known as a **one-time password (OTP)**. This is one of the most commonly used forms of multi-factor authentication. Let's take a closer look at what one-time passwords are.

A one-time password, like its name indicates, is a pseudo-randomly generated password that expires after a short time period and is only valid for one login. They are typically paired with a traditional username and password to make the authentication process more secure. Even if a user has a weak or reused password, the one-time password that is sent to them is a way to indirectly strengthen their credentials.

There are a few different ways to send one-time passwords to users.

#### SMS

SMS is one of the most user-friendly ways to send one-time passwords. The user signs in to your application with their username and password, and then they receive a text message to their cell phone with their OTP. They're able to easily copy the code from the text message and send it back to the application.

While this may be simple for the user, and it's better than not having MFA at all, it's still [not the best way](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/#The-SMS-Controversy) to send or receive one-time passwords.

Believe it or not, delivering an OTP through SMS carries the risk of compromise. Here are some of the ways that an attacker can gain access to your OTP through SMS:

- **Social Engineering** &mdash; An attacker that has breached a user's username and password may also have access to their phone number. Attackers have been known to obtain SMS-delivered one-time passwords by sending a text to the user telling them that they used to have the same phone number as them, and they are locked out of one of their accounts because they forgot to update the phone number listed on the account. They politely ask for the code that was just sent to the user's cell phone, so they can get back into their account. Many people want to help the person on the other end, so they text them the code without thinking much of it.

- **SIM Swap** &mdash; [SIM swapping](https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how-protect-yourself) (also known as simjacking) is when an attacker gains access to your cell phone number. One interesting (and terrifying) way this can happen is by an attacker calling your cell phone provider and convincing them that they lost their phone and need a new SIM card activated. The SIM card that gets activated is one that the attacker owns. If the cell phone provider obliges, then the attacker now has access to any text messages, phone calls, etc. that come through. So, if they already have your username and password, all they have to do is type in the OTP that is texted to your phone number (which they now have access to), and they're in! This [Hacking Challenge at Defcon video](https://www.youtube.com/watch?v=fHhNWAKw0bY) has an excellent demonstration of this in action.

#### Email

Another option for receiving OTPs is through email. While this does provide another step to access your account, which is great, it still has some downfalls:

- Because [password reuse is so prevalent](https://www.zdnet.com/article/44-million-microsoft-users-reused-passwords-in-the-first-three-months-of-2019/), there's a chance that a user's email password is the same as the account that's requesting the OTP. Assuming the attacker already has this password, then the extra step of the OTP is useless.

- One of the requirements for MFA is that the implemented factors come from at least two of the MFA categories: something you know, something you have, and something you are. The username and password fulfill **something you know**, and OTP is meant to fulfill **something you have**. Ideally, something you have would be a physical item, such as your cell phone. Having access to an email account doesn't necessarily mean that the cell phone is in your possession, as you could access your email from any device. 

#### Authenticator apps

Another common way to manage OTPs is with authenticator apps. Once you install the app up on your cell phone, you can set up any accounts that work with the authenticator app to send your one-time passwords to that app. The OTPs will typically regenerate every 30 seconds, so instead of waiting for an email or a text message, you simply open up the app, and you'll always find a valid OTP there.

There are a lot of authenticator app options. Some of the most popular ones are [Duo](https://duo.com/), [Authy](https://authy.com/), and [Google Authenticator](https://support.google.com/accounts/answer/1066447).

An authenticator app is an excellent choice for receiving one-time passwords. Unlike SMS, an attacker can't access your authenticator app simply by having access to your text messages or phone number. Your one-time passwords also can't be stolen if someone gains access to your email account.

There are, however, still downsides to authenticator apps. Some users may find it too much of a hassle to download a new app and set up all of their accounts on it to receive one-time passwords, especially when it's so much easier to just enter their phone number instead.

Another issue is that if you lose your cell phone, accessing those accounts that have MFA enabled can quickly become a nightmare. Most popular authenticator apps now have [safeguards, such as key backups, built-in](https://authy.com/blog/how-the-authy-two-factor-backups-work/). To enable backups, you have to create a strong password that's used to encrypt your OTPs. Then, if you ever lose your phone, you can install the authenticator app on your new phone and type in your password to decrypt your keys.

## Step-up Authentication

You may have noticed a common theme amongst the downsides to some of the OTP options: **user experience**.

One of the biggest obstacles to mass adoption of MFA is the slight hit that user experience takes. Generally, the more steps you require to sign in to your application, the fewer people will want to use it.

To manage the balance between user experience and security, some people find it best not to require MFA on every login, but instead, require it when accessing more sensitive data.

> With [step-up authentication](https://auth0.com/docs/mfa/concepts/step-up-authentication), applications that allow access to different types of resources can require users to authenticate with a stronger authentication mechanism to access sensitive resources.

For example, say you have an application that requires users to sign in with their email and password to access customer data. However, when a user wants to see employee data, an **extra authentication factor** is required.

![Auth0 step-up authentication](https://images.ctfassets.net/23aumh6u8s0i/7AkLMOctLnHeZk8BFrw3fz/7aa520a8fa86e9f485d809c0aec4f0d2/step-up-authentication-flow)

Step-up authentication is an excellent option to bridge the gap between user experience and security.

## Implementing Multi-factor Authentication with Auth0

Now that you've seen why multi-factor authentication is important, you're probably wondering *how* you can implement it into your own apps. Let's go through how you can get MFA up and running in just minutes using [Auth0](https://auth0.com).

To start, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>. Once you go through setup, leave the tab open, as you'll be returning to it soon.

Next, you're going to clone this [sample React application](https://github.com/auth0-blog/auth0-react-sample) that has already been set up to use Auth0 for authentication.

> If you'd like to know more about how this application was built, check out [The Complete Guide to React User Authentication](https://auth0.com/blog/complete-guide-to-react-user-authentication/).

In your terminal, run the following:

```bash
git clone git@github.com:auth0-blog/auth0-react-sample.git
cd auth0-react-sample
npm install
```

Next, create the `.env` file in your `auth0-react-sample` root directory:

```bash
touch .env
```

This is where you'll store your Auth0 variables so that you can connect your React application to Auth0. Paste the following into `.env`:

```
REACT_APP_AUTH0_DOMAIN=
REACT_APP_AUTH0_CLIENT_ID=
```

Back in the [Auth0 dashboard](https://manage.auth0.com/dashboard/), click on "**Applications**" and then on the "**Create Application**" button.

Name your application anything you'd like, click on "Single Page Web Applications", and then click "Create".

![Auth0 new application](https://images.ctfassets.net/23aumh6u8s0i/4qVyZ0Mpj5B9GhqeZuSc3Y/4aeab2a7cfaf7ebddf030ba9da13106f/new-auth0-application)

Click on the "**Settings**" tab. Paste the development URL for your React application (`http://localhost:4040`) into the text area under "Allowed Callback URLs", "Allowed Logout URLs", and "Allowed Web Origins".

**Allowed Callback URLs**: `http://localhost:4040`

**Allowed Logout URLs**: `http://localhost:4040`

**Allowed Web Origins**: `http://localhost:4040`

❗ Make sure you scroll down to the bottom and click "Save changes".

Next, you'll need to paste some of these values from the Settings page into your React application's `.env` file so that the Auth0 authentication server recognizes your React application.

Back in your code editor, open your `.env` file. Set `REACT_APP_AUTH0_DOMAIN` to the value for "Domain" from the Auth0 Settings page and `REACT_APP_AUTH0_CLIENT_ID` to the value of "Client ID". 

```
REACT_APP_AUTH0_DOMAIN=your-domain.auth0.com
REACT_APP_AUTH0_CLIENT_ID=yourclientidstring
```

Save this and then start your React application by running the following in your terminal:

```bash
npm start
```

Head to [`http://localhost:4040/`](http://localhost:4040/) in your browser to see your application live.

To test it out, click on the "Log In" button. You'll be redirected to the Auth0 Universal Login page (https://your-domain.auth0.com/login), where you can sign up as a new user. 

![Auth0 signup/login page](https://images.ctfassets.net/23aumh6u8s0i/6ToiqA66XF0UEs1OhYZ2Dw/66e51832bd2c5976b128ecf072927494/auth0-login-screen)

And just like that, you've successfully set up authentication on your demo React application! However, as you know from learning about MFA, this username and password approach leaves a little to be desired. Let's see how you can step up your application's security a notch by turning on multi-factor authentication.

### Enabling MFA with Auth0

Head back to the Auth0 dashboard and click on [**Multifactor Auth**](https://manage.auth0.com/dashboard/#/mfa) in the sidebar.

![Auth0 MFA](https://images.ctfassets.net/23aumh6u8s0i/7wWKd6DIOFnWafex1Iu4rT/c3df03c639a32e4679390c5b1223a7d5/mfa-dashboard.png)

There are a few options here that you can choose. To quickly see MFA in action, select "Phone Message". Scroll down a little and select "Always" from the "Require Multi-factor Auth
" dropdown, and then press "Save".

![Auth0 MFA phone number](https://images.ctfassets.net/23aumh6u8s0i/2jbVMojYAIwwnldyQBMCIY/07413d4028ea0afa75caf81f4f151969/auth0-mfa-phone-number)

Head back to your React application, sign out, and then sign back in. After entering your email and password, you'll be prompted to enter your phone number. Once you do, you'll be asked to enter the 6-digit code that was texted to you.

![Auth0 MFA text OTP](https://images.ctfassets.net/23aumh6u8s0i/4TisUePt1RFWO7GCoxiqnN/208fb3f7ab33d6be9120c862e862952c/auth0-mfa-text-otp)

![Auth0 MFA text OTP code](https://images.ctfassets.net/23aumh6u8s0i/7lCkR3RkB3XqjpIDsEk7F0/283bd91de9a1b338493df8d0361c4137/sms-otp)

Type in the code that you received to your cell phone, and then click "Continue". You'll then be asked to copy a recovery code. This is one of the safeguards that we covered back in the Authenticator Apps section that will allow you to recover your account if you ever lose your phone.

![Auth0 MFA recovery code](https://images.ctfassets.net/23aumh6u8s0i/1fK66CyrkCPmjghImTP4Hb/0e6390f24f78f7758cb8bc40b4130bbe/auth0-mfa-recovery)

Once you've copied it and pressed "Continue", you'll be redirected back to the React application, and you're now signed in!

🎉 **You just enabled MFA on your application in a matter of minutes!**

Auth0 offers several different options for MFA. This demo showed how to set up an SMS one-time password for the sake of simplicity, but if you'd prefer an even better option, you can choose from some of the authenticator apps that are offered. Feel free to experiment in the dashboard and see what works best for you!

## Wrap Up

If you need any more convincing about the need for multi-factor authentication, have a look at the popular website [haveibeenpwned.com](https://haveibeenpwned.com/). The website collects data on password breaches. You can type in your email address to see if it has been involved in any publicly known data breaches. As of writing this, there are **over 10 billion accounts** listed. So, even if you have a strong password, you're trusting the websites you use to keep that password safe, which unfortunately doesn't always happen.

While it's on your mind, take this time to go review your important accounts to make sure you have MFA enabled. Nobody wants to deal with the fallout of canceling their credit cards, dealing with stolen funds, and resetting all of their passwords because their bank account was breached due to weak credentials. Make sure you're always on the offensive by securing your accounts as much as possible! And if you run a website, take care of your users by giving them the means to secure their accounts on your application.

Be sure to reach out in the comments below or [find me on Twitter](https://twitter.com/hollylawly) if you have any questions. Thanks for reading!

Multi-factor Authentication Guide

Why more companies are entrusting identity to the experts in the name of security and growth


Every organization that uses a login box must have some form of identity and access management (IAM) system to keep track of users and control access to data and services. But in recent years, managing identity has become more complex. Today, identity management is inextricably bound to issues of security, user experience (UX), and scalability.

To cope with the challenge of maintaining IAM systems, more and more organizations are turning to Identity-as-a-Service (IDaaS) providers.

But what exactly is Identity-as-a-Service? What do these providers offer that can help businesses navigate such a challenging environment?

In this piece, we’ll define identity as a service &mdash; its core components and the reasons why it’s a rapidly growing segment of Software-as-a-Service (SaaS).

## IDaaS Defined

When an organization creates or updates an application, they have to choose which functionalities to write themselves and which to entrust to a third party. For instance, if you’re writing an application that takes payments, it’s often more time- and cost-effective to use a platform like Square rather than making your own payment system from scratch. 

The same holds true if your application requires users to log in. Given the complexities of logins and the many ways that identity management touches on analytics and security, it’s often simplest to purchase an IDaaS solution that integrates into your software and handles these issues for you.

IDaaS providers offer cloud-based solutions for IAM functions. 

When you purchase an IDaaS service, you’re essentially purchasing an API (Application Programming Interface). In the simplest terms, an API is a set of programmed rules for how software components or applications interact, like a translator or mediator. 

In the case of IDaaS, the API mediates the authentication flow between the end-user and the customer’s application(s). IDaaS may also be used to mediate Authorization to certain areas of the application or to access certain data within the application(s) your company is building.  

When we talk about managing identity, we’re referring to the identities of three basic classes of users:

* Customer identity and access management (CIAM), which applies to end-users.
* Workforce IAM, which manages your staff and their access to internal applications.
* B2B IAM, which lets businesses integrate identity with their business partners and enterprise customers.

Each of these classes requires a different approach, and an organization may subscribe to an IDaaS provider for all of them or just one.

There are a few core features common to virtually all IDaaS providers. These include:

* Multi-factor authentication (MFA)
* Biometrics
* Single Sign-On (SSO)
* User management and access control

We’ll get deeper into all those terms below.

### Multi-Factor Authentication (MFA)

[MFA](https://auth0.com/docs/mfa) is an increasingly popular way of verifying a user’s identity. It’s more secure than the traditional username/password method of logging in since [passwords are vulnerable to multiple types of attacks](https://auth0.com/blog/what-is-broken-authentication/#:~:text=Auth0%20Docs&text=Broadly%2C%20broken%20authentication%20refers%20to,to%20masquerade%20as%20a%20user.).

MFA requires users to log in with more than one piece of identifying information (i.e., a push notification in addition to a password).

Users must share some combination of the following credentials to log in:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a cell phone)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The most common form of MFA is two-factor authentication (2FA), though you may customize an MFA solution to ask for more credentials depending on the security risk.

Despite numerous reports on [the benefits of multi-factor authentication for stopping data breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), widespread adoption is still surprisingly low &mdash; though it has increased significantly in recent years:

![2fa-blog](https://images.ctfassets.net/23aumh6u8s0i/3UNdOb3k1qtTTy3vXU2NhJ/ca5386396ac47062473b3562d3314c9f/2fa-blog)

One of the reasons for the lagging adoption rate is that designers are wary of creating extra friction at login, especially for B2C authentication. But third-party IDaaS providers offer more customizable MFA options, like [step-up or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/). These approaches to MFA only ask for extra credentials if a user meets a certain risk profile; for instance, logging in from a new IP address or changing payment information.

### Biometrics

Biometrics means the use of an “inheritance” criteria &mdash; something the user is as a means of verification. If you’ve ever unlocked your smartphone with your thumbprint, you’re familiar with biometrics.

![biometrics](https://images.ctfassets.net/23aumh6u8s0i/4H45r7da3K3WplJ96rXE8B/ea359f09fc4bd01419eebdc67f09f29d/biometrics)

In addition to thumbprints, other biometric authentication methods include iris or retina recognition, full [facial recognition](https://www.syte.ai/blog/brief-history-image-search/), fingerprint, hand, and DNA usage.

Many organizations are excited to use this technology and have turned to IDaaS providers to implement it rather than trying to train their in-house teams on this specialized branch of knowledge.

### Single Sign-On (SSO)

[Single Sign-On (SSO)](https://auth0.com/single-sign-on) allows users to log in to one application and then automatically be logged in to other designated applications. Most people are familiar with SSO through Google, since signing in to one Google property such as YouTube grants you access to Gmail and other applications. SSO is popular for companies with multiple brands since it allows for greater user visibility, as well as reduced friction. There are also use cases for SSO in workforce and B2B identity management.

![Single Sign-On (SSO) in action](https://images.ctfassets.net/23aumh6u8s0i/6t0LdnTcofxK6ekdSpDEja/a7376b8f04ca074a0d88dd1470d3be55/sso-desktop.jpeg)

### User management and access control

One essential element to any IAM system is the ability to control who is permitted to access data by provisioning users with different roles. IDaaS systems simplify this process by centralizing identity and putting these controls into a single location like a user dashboard. That’s a significant advantage in making sure sensitive data stays in the right hands since it’s much less prone to error than an IT team manually controlling access to individual applications.

## Why Enterprises Choose IDaaS

IDaaS is undergoing a period of exponential growth as more companies—from startups to multinational corporations—decide to outsource identity. The IDaaS market is [predicted to grow](https://www.marketsandmarkets.com/Market-Reports/identity-as-a-service-market-32235637.html) from $2.5 billion in 2019 to $6.5 billion in 2024.

Why this shift toward third-party identity solutions? The reasons include the need to meet legal requirements, manage security risks, and implement an identity solution designed around scalability and extensibility.

### Data privacy law compliance

One of the reasons that IDaaS has become so important recently is the rush to comply with new data privacy regulations. These include the [EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA)](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and others.

Organizations that fail to comply with these regulations can face stiff penalties. For instance, under GDPR, organizations without secure and transparent data practices can be fined up to 20 million euros or 4% of annual global turnover &mdash; whichever is higher.

![GDPR compliance checklist](https://images.ctfassets.net/23aumh6u8s0i/4XXboWYzyp7LPl5BulfQsM/4a439e75374582bfe2a5cea60fb02120/gdpr-compliance-checklist)

Data privacy laws often grant users more rights over their data. These rights vary depending on the law, but they may include:

* A new right to data portability
* An extended right to be forgotten (also called the right to erasure)
* The right to opt in or out of data collection and sales

These rights translate to a new set of obligations for organizations. It’s now essential to have a centralized repository of user data to satisfy reporting requirements and protect sensitive data according to current best practices. Data privacy laws are rapidly evolving, and managing compliance can be a full-time job, especially for organizations with uses in multiple jurisdictions.

Managing compliance is a major undertaking for any company. However, relying on an IDaaS partner can keep track of even siloed identity stores. A centralized identity solution can deliver lower maintenance costs and greater peace of mind. Although an IDaaS provider can’t ensure your organization will be fully compliant, IDaaS tools can certainly help.

### Increased security With IDaaS

In recent years, identity has become a major source of [high-profile hacks and data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/). In fact, Verizon’s [2020 data breach report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that over 80% of breaches from hacking involved brute force attacks or the use of lost or stolen credentials.

The best protection against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) are the features IDaaS providers specialize in: MFA, brute force and anomaly detection, and rigorous access control.

### Extensibility, adaptability, scalability

Legal and security concerns are the most frequently mentioned benefits of partnering with an IDaaS provider, but a sophisticated approach to identity can also help growing companies boost their bottom lines. Organizations with custom-built IAM solutions frequently find that maintaining these systems and adapting them to new needs and partners takes months of developer time.

For instance, in 2019, Apple mandated that [every app on the App Store had to include “Sign in with Apple” as a login option](https://developer.apple.com/news/?id=09122019b). Companies with bespoke IAM systems scrambled to meet this requirement, and many found that their systems were rigid and full of legacy code. Most IDaaS providers, on the other hand, included this as a simple update.

Having an extensible identity platform is also essential to integrating users during [Merger and Acquisition (M&A) deals](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) and in deals between enterprises. Two organizations with IAM systems that can’t talk to one another can’t benefit from each other’s data, but an IDaaS provider can act as a translator between different back ends.

## What’s Ahead For IDaaS

IDaaS is an increasingly important segment of SaaS, propelled by new regulations, heightened security risks, and excitement about new technology.

Even organizations that typically adopt a "Do it yourself" (DIY) attitude about building their own features are beginning to recognize the value of relying on third-party identity providers. They can make that switch at any stage: during initial product development, prior to release, or at an inflection point at which they see the limits of their in-house IAM system.

The definition of IDaaS will continue to evolve as providers add new features, but the need for specialized expertise to handle these matters will remain constant.

<include src="asides/AboutAuth0" />


What Is IDaaS?

Fintech companies must evolve their identity strategy for the future of banking.



A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />


"identity-access-management"