TL;DR
Adaptive authentication dynamically adjusts login requirements based on user behavior, location, and risk level — tightening security for suspicious activity while reducing friction for routine access. Unlike static authentication, it balances protection and usability, and can help organizations avoid the average average of $3.86 million cost of a data breach. Okta's adaptive authentication offers a configurable solution for businesses of any size.
What is adaptive authentication?
If you use adaptive access control, your visitors will encounter a computer program before they can log in. That program assesses the risks in each visit (based on criteria you define) and adjusts authentication requirements accordingly. In traditional authentication systems, you ask all of your users to do one or two things each time they visit, such as typing in a password or submitting a fingerprint. Adaptive access lets you add or remove complexities depending on who your user is, where that user is, or what the user is trying to do.
When we think about systems like this, we immediately contemplate programs that make access harder. For example, we imagine programs that require a retina scan before users can do something important like transfer funds.
How does adaptive access control reduce friction?
But adaptive access control can also make simple tasks easier to complete. If you're simply trying to look at your personal calendar, for example, you could skip several security hoops. Given that a third of us admit to so-called "password rage," simplifications like this could be welcome.
Balancing security and usability is also key to keeping your employees happy with their workplace technology.
How does adaptive access work?
Adaptive programs work like access gatekeepers. Users must interact with them before they can tap into your servers.
Every program is different. But here's a quick rundown of how most work:
- Highlight dangers. Outline the risks by user role, location, time of day, and resource requested. Give each user a profile, so the program can learn how these people typically interact with your system.
- Determine baseline rules. Define the lowest authentication method you'll accept and stratify risks accordingly. Tell the program how you'd like to handle each scenario.
- Turn on the program. Each time a user tries to log in, the program evaluates the request and assesses risk. Authentication processes adapt accordingly.
3 examples of adaptive access control
Let's imagine an accountant named Mike. He's based in Sacramento, and he's worked for your company for 10 years. Let's walk through what his experience of adaptive authentication might look like.
| Scenario | Trigger Condition | System Response |
|---|---|---|
| 1 | Login to accounting server at 8 a.m. from familiar IP (30-day pattern) | Password only |
| 2 | Login to accounting server at 2 a.m. from familiar IP (unusual time) | Password + code sent to authenticated phone |
| 3 | Login to marketing server at 2 a.m. from unfamiliar IP | Password + secondary code + biometric fingerprint |
Should you try adaptive access?
Few companies can afford a catastrophic data breach. Even if you can pay the fees and recover lost money, your reputation as a safe and secure provider may be gone forever.
We can help. Okta offers an adaptive authentication product we think you'll love. Find out how it works.
Frequently asked questions
What is adaptive authentication?
Adaptive authentication is a system that evaluates risk factors for each login attempt and adjusts the required credentials accordingly, rather than applying the same authentication method to every user every time.
How is adaptive authentication different from traditional authentication?
Traditional systems apply the same one or two credential checks to all users on every visit, while adaptive authentication tailors requirements based on user profile, location, time, and the resource being accessed.
What factors does adaptive access control evaluate?
Factors include user role, location, time of day, IP address familiarity, and the specific resource or server being requested.
Can adaptive authentication make logging in easier, not just harder?
Yes. For low-risk, routine access (such as viewing a personal calendar), adaptive systems can reduce authentication steps, addressing common user frustration with excessive security prompts.
What are the steps to set up an adaptive access control program?
(1) Define risks by user role, location, time, and resource; (2) establish baseline authentication rules and risk stratification; (3) activate the program so it evaluates and adapts each login request in real time.
Why is investing in adaptive authentication worth the cost?
A single data breach cost companies an average of $3.86 million in 2020, making proactive investment in adaptive security a financially sound decision compared to post-breach damage control.
References
What Is the Cost of a Data Breach? (August 2020). CSO.
Do You Have 'Password Rage?' A Third of People Admit to Tantrums Over Password Frustration. (June 2015). InformationAge.
