Welcome!

News Feed Item

SecureAuth Launches New Capability Reducing Exploits for Mobile Multi-Factor Authentication

User-friendly Symbol-to-Accept mobile authentication solution provides same great user experience as push-to-accept but is more secure

IRVINE, CA --(Marketwired - November 30, 2016) - SecureAuth Corporation, the leader in adaptive access control, today announced the launch of Symbol-to-Accept, a patent-pending mobile multi-factor authentication approach that improves security without compromising the convenience of the popular push-to-accept method. Expanding on the convenience of push-to-accept, Symbol-to-Accept increases security by reducing the risk of users routinely pressing "accept" even if they did not initiate the authentication attempt themselves. While the use of push-to-accept has exploded due to its simplicity and speed, it exposes enterprises to risks when users may inadvertently approve login requests that they did not initiate. This could allow an attacker to bypass the intended protection of multi-factor authentication and breach the user's account.

Symbol-to-Accept, however, enables security-conscious enterprises to deploy mobile push authentication with confidence to mitigate this risk. Preserving the user convenience with Symbol-to-Accept, the user is presented a small number of "accept" buttons displaying single, randomly-selected symbols (such as letters). To successfully log in, the user selects the correct symbol on their mobile device that matches one displayed on their computer's login screen. This choice dramatically reduces the likelihood that the user will approve an unsolicited login request because they will not know which button to choose if they are not currently trying to log in.

Weaknesses of Push-to-Accept

With traditional push-to-accept methods, users that routinely press "accept" for authentication sequences may reflexively approve an unsolicited login request as a way to clear the notification from their mobile device screen. Unfortunately, this may grant an attacker access without the user ever becoming aware that their user identity has been stolen. Symbol-to-Accept avoids this conditioning where users automatically press "accept" out of habit, even if they did not initiate the authentication attempt themselves.

"Push-to-accept is arguably one of the most convenient forms of multi-factor authentication," said Keith Graham, CTO at SecureAuth. "Unfortunately, while traditional push-to-accept authentication provides a great user experience, it is prone to exploit by attackers, who may bombard the user with push-to-accept requests -- to the point where the user will eventually hit 'accept' to make the requests go away. And for cybercriminals, it's a numbers game -- bombard as many users with requests as necessary until the desired outcome is achieved."

Balancing Security and User Experience

Maintaining a convenient user experience is a top concern for IT decision makers when implementing authentication solutions. According to a recent SecureAuth survey, 42 percent of respondents cited disruption to users' daily routine as a hindrance for not adopting an improved authentication strategy. Symbol-to-Accept provides users with the same convenience of push-to-accept authentication; however, Symbol-to-Accept increases security by requiring the user to take an additional cognitive step of selecting the symbol displayed on their mobile device that corresponds to the symbol displayed on the screen in their web browser.

"To satisfy today's changing enterprise landscape, it's essential for security solutions to evolve at the pace of new emerging threats as well as meeting practical organizational needs," said Graham. "Some organizations are already moving to stronger methods of user authentication, including adaptive access control techniques safeguarding critical areas, such as Single Sign-On (SSO) portals and self-service password reset applications. It is imperative that more organizations take this lead and look to implement adaptive access in a way that, in addition to Symbol-to-Accept, performs risk-analysis as part of the authentication process. Adaptive techniques, such as device recognition, geo-location, the use of threat services, and even behavioral biometrics, enable organizations to take control of their authentication process without compromising user experience."

About SecureAuth
SecureAuth is the leader in adaptive access control solutions, empowering organizations to determine identities with confidence. SecureAuth provides strong identity security while minimizing disruptions to the end-user. SecureAuth has been providing SSO and MFA solutions for over a decade. For the latest insights on adaptive access control, follow the SecureAuth blog, follow @SecureAuth on Twitter and on LinkedIn, or visit www.secureauth.com.

More Stories By Marketwired .

Copyright © 2009 Marketwired. All rights reserved. All the news releases provided by Marketwired are copyrighted. Any forms of copying other than an individual user's personal reference without express written permission is prohibited. Further distribution of these materials is strictly forbidden, including but not limited to, posting, emailing, faxing, archiving in a public database, redistributing via a computer network or in a printed form.

Latest Stories
In IT, we sometimes coin terms for things before we know exactly what they are and how they’ll be used. The resulting terms may capture a common set of aspirations and goals – as “cloud” did broadly for on-demand, self-service, and flexible computing. But such a term can also lump together diverse and even competing practices, technologies, and priorities to the point where important distinctions are glossed over and lost.
Predictive analytics tools monitor, report, and troubleshoot in order to make proactive decisions about the health, performance, and utilization of storage. Most enterprises combine cloud and on-premise storage, resulting in blended environments of physical, virtual, cloud, and other platforms, which justifies more sophisticated storage analytics. In his session at 18th Cloud Expo, Peter McCallum, Vice President of Datacenter Solutions at FalconStor, discussed using predictive analytics to mon...
All clouds are not equal. To succeed in a DevOps context, organizations should plan to develop/deploy apps across a choice of on-premise and public clouds simultaneously depending on the business needs. This is where the concept of the Lean Cloud comes in - resting on the idea that you often need to relocate your app modules over their life cycles for both innovation and operational efficiency in the cloud. In his session at @DevOpsSummit at19th Cloud Expo, Valentin (Val) Bercovici, CTO of Soli...
Information technology is an industry that has always experienced change, and the dramatic change sweeping across the industry today could not be truthfully described as the first time we've seen such widespread change impacting customer investments. However, the rate of the change, and the potential outcomes from today's digital transformation has the distinct potential to separate the industry into two camps: Organizations that see the change coming, embrace it, and successful leverage it; and...
Without a clear strategy for cost control and an architecture designed with cloud services in mind, costs and operational performance can quickly get out of control. To avoid multiple architectural redesigns requires extensive thought and planning. Boundary (now part of BMC) launched a new public-facing multi-tenant high resolution monitoring service on Amazon AWS two years ago, facing challenges and learning best practices in the early days of the new service. In his session at 19th Cloud Exp...
Extracting business value from Internet of Things (IoT) data doesn’t happen overnight. There are several requirements that must be satisfied, including IoT device enablement, data analysis, real-time detection of complex events and automated orchestration of actions. Unfortunately, too many companies fall short in achieving their business goals by implementing incomplete solutions or not focusing on tangible use cases. In his general session at @ThingsExpo, Dave McCarthy, Director of Products...
Regulatory requirements exist to promote the controlled sharing of information, while protecting the privacy and/or security of the information. Regulations for each type of information have their own set of rules, policies, and guidelines. Cloud Service Providers (CSP) are faced with increasing demand for services at decreasing prices. Demonstrating and maintaining compliance with regulations is a nontrivial task and doing so against numerous sets of regulatory requirements can be daunting task...
Fact: storage performance problems have only gotten more complicated, as applications not only have become largely virtualized, but also have moved to cloud-based infrastructures. Storage performance in virtualized environments isn’t just about IOPS anymore. Instead, you need to guarantee performance for individual VMs, helping applications maintain performance as the number of VMs continues to go up in real time. In his session at Cloud Expo, Dhiraj Sehgal, Product and Marketing at Tintri, sha...
The Internet of Things (IoT) promises to simplify and streamline our lives by automating routine tasks that distract us from our goals. This promise is based on the ubiquitous deployment of smart, connected devices that link everything from industrial control systems to automobiles to refrigerators. Unfortunately, comparatively few of the devices currently deployed have been developed with an eye toward security, and as the DDoS attacks of late October 2016 have demonstrated, this oversight can ...
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to impr...
Join Impiger for their featured webinar: ‘Cloud Computing: A Roadmap to Modern Software Delivery’ on November 10, 2016, at 12:00 pm CST. Very few companies have not experienced some impact to their IT delivery due to the evolution of cloud computing. This webinar is not about deciding whether you should entertain moving some or all of your IT to the cloud, but rather, a detailed look under the hood to help IT professionals understand how cloud adoption has evolved and what trends will impact th...
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
Businesses and business units of all sizes can benefit from cloud computing, but many don't want the cost, performance and security concerns of public cloud nor the complexity of building their own private clouds. Today, some cloud vendors are using artificial intelligence (AI) to simplify cloud deployment and management. In his session at 20th Cloud Expo, Ajay Gulati, Co-founder and CEO of ZeroStack, will discuss how AI can simplify cloud operations. He will cover the following topics: why clou...
Internet of @ThingsExpo, taking place June 6-8, 2017 at the Javits Center in New York City, New York, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo New York Call for Papers is now open.