Story image

Yahoo breach news is shocking but not surprising - what to do now?

28 Sep 16

The 2014 compromise of a half billion user records at Yahoo! by a state-sponsored actor is shocking but not surprising. For years, we have been noting (what our clients have told us),  which is that:

·       More American identities have been compromised than have not (See The Global Identity Dilemma: Static Biometrics are NOT the answer ).

·       State sponsored actors are buying up enormous amounts of stolen identity and account data for intelligence purposes (See Where has all the Stolen Data Gone ) in order to steal information and assets from companies in the U.S. and across the globe.

·       Fraudsters use stolen credentials and data to take over accounts at online service providers in widespread and hard-to-detect ‘credential stuffing’ attacks (see  Where have all our passwords gone).

Identity Proofing Solutions

Identity proofing is clearly a top global fraud issue. What can organisations who need to prove electronic identities do to overcome this issue?

In our last blog, we summarised our bottom-line recommendation that organisations REDUCE reliance on STATIC data, such as the data compromised in the Yahoo! breach, and instead INCREASE their reliance on DYNAMIC information. (See The Global Identity Dilemma: Static Biometrics are NOT the answer ).

Here we present a four-layer identity proofing approach (See Absolute Identity Proofing is Dead; Use Dynamic Identity Assessment ) that outlines the types of measures that should be implemented to achieve high confidence in user identities. These measures should be taken upon every risky transaction, such as new account creation, log in, changes to profile data (e.g. address, phone number), and financial transactions such as purchases, money transfers, use of stored value in loyalty programs and other electronic wallets, and more.

User authentication is not a binary yes/no process anymore. The days of confidently verifying an identity based on a password or even a static biometric are over.  A continuous layered identity proofing approach must be used because static credentials can and have been compromised and accounts taken over.

Out of band push notification – not a panacea either

Several seasoned fraud managers I speak with are turning to out-of-band push notifications on mobile phones in order to confidently authenticate a user (along with a layered identity proofing approach). This will provide a strong second factor authentication factor, as they plan to verify the phone belongs to the legitimate user through ‘device binding’ during user enrollment. This sounds like the strongest user authentication method around, especially if it also includes the use of dynamic biometrics on top of the push notification app.

But even this method is bound to be circumvented one day, at the least when fraudsters socially engineer a consumer to authenticate themselves during a fraudulent transaction that the fraudster is conducting surreptitiously against their account                            .

There’s no getting around defense in depth and a layered continuous identity proofing approach. That job is getting harder by the day, as more and more stolen identity-related records sit around in criminal databases, just waiting to be sold and used. The only comfort I get personally is in the law of statistical averages. I just keep hoping the criminals won’t have enough time to get around to using my identity. Famous last words…

Article by Avivah Litan, analyst at Gartner

Red Hat names local APAC innovation award winners
ANZ Bank and NZ Customs Service were honoured as Red Hat Innovation Awards APAC 2018 Winners in A/NZ.
IP theft: A global issue catching NZ businesses off guard
“We have this incredible record of innovation in New Zealand. But our innovative businesses haven’t always been meticulous in shoring up their IP."
Why A/NZ organisations need to improve compliance protocols
Only a mere 4% of IT decision makers and data managers surveyed said their organisation faced no data management challenges. 
AWS tops all four global markets, APAC a unique case
The order of proceedings remains relatively the same in three of the four major regions for public cloud services providers, but the APAC market is bolstered by the prominence of China.
How artificial intelligence is transforming finance teams
"Organisations using cognitive ergonomics and system design in new AI projects will achieve long-term success four times more often than others.” 
Pure Storage launches new cloud data services
“Customers should be able to make infrastructure choices based on what’s best for their environment, not constrained by what the technology can do."
Is self-service BI living up to the hype?
the explosion of data available to a business and self-service BI tools is transforming how everyone works - but is self-service living up to expectations?
What the people say - Gartner’s November Customers’ Choices
A roundup of the latest Gartner Peer Insight Customers’ Choices from Backup and Recovery to Business Intelligence and Analytics, and more.