Customers in the Crosshairs

As users now expect more from the organisations they interact with online managing the identity of your customers is becoming much more complex. Password dumps, multiple devices and poor MFA adoption put pressure on security and development teams. All the time your competition is waiting in the wings to offer an alternative if your offering doesn't meet the customer's expectations.

Join Andy in a session where he discusses the threats to your customers, the impact those threats can have on your organisation and how to build a customer identity which not only protects your customers but provides a better user experience.

What attendees will learn:
- How to model the risks and impacts of a customer account compromise.
- How to drive registration with progressive profiling.
- Choosing multi-factor options which users love.
- Techniques for monitoring emerging account threats.

Transcript

1. Customer Identities in the Crosshairs Photo by Heamosoo Kim on Unsplash
2. 10+ years working in secure systems Hi! Technical Product Manager at Okta Software Developer (.NET / Java / JS) @andymarch
3. Customer experience is critical
5. The Future of Customer Experience
6. Don’t let customer experience become a security risk
8. <50% use a unique password for email
9. 1111111 (3.1m) Password (3.6m) Qwerty (3.8m) 123456789 (7.7m) 123456 (23.2m)
11. What’s the risk?
13. 42% expect to be a victim of financial fraud online
15. Username/password PII Transaction History Linked Payment Information Redeemable tokens Initiate transaction Failed login limits IP blacklists Captcha Credentials Mitigations Identity Resources
16. Come on, tell me who are you?
19. ? id: 123456789 email: mail@testuser.com id: 123456789 email: mail@testuser.com address: 123 Fake Street id: 123456789 email: mail@testuser.com address: 123 Fake Street loyaltyid: 098765
20. Email address Manage Contact Preferences Credentials Mitigations Identity Resources id: 123456789 email: mail@testuser.com
21. Email address Manage Contact Preferences Credentials Mitigations Identity Resources id: 123456789 email: mail@testuser.com Manage Existing Order Manage Address address: 123 Fake Street Email address/Password password: supersecret
22. Do I need to create an account?
24. US Adults with an account Facebook: 69% LinkedIn: 28% Twitter: 23% Reddit: 18% Source: pewresearch.org/internet/fact-sheet/social-media Social media usage by age 18-29: 84% 30-49: 81% 50-64: 73% 65+: 45%
26. Image: 9to5mac
27. Image: TechCrunch
30. Pre-hijacked accounts
31. The limiting factor
32. ******** someuser password Passw0rd!
38. twofactorauth.org
40. Your code is 123456
41. Photo by Andrey Metelev on Unsplash
43. OS based (with TPM) Browser Integration (WebAuthN) Roaming Authenticators (CTAP)
44. Email address/Password Manage Contact Preferences Credentials Mitigations Identity Resources id: 123456789 email: mail@testuser.com Manage Existing Order Manage Address address: 123 Fake Street password: supersecret loyaltyid: 098765 Redeem Loyalty Points + MFA
45. Everything in context
46. Who is the user? What is the application? Where is the user? What is the action? Does it match their normal usage? User supplied context Service inferred context
47. Email address/Password Manage Contact Preferences Credentials Mitigations Identity Resources id: 123456789 email: mail@testuser.com Manage Existing Order Manage Address address: 123 Fake Street password: supersecret New device New location Contact support
48. Understanding normal
50. Putting it all together
51. Email address/password Manage Contact Preferences Credentials Mitigations Identity Resources id: 123456789 email: mail@testuser.com Manage Existing Order Manage Address address: 123 Fake Street password: supersecret New device New location Contact support MFA Passed
52. React to change Know your users, know your risk Collect only what you need when you need it Strongly authenticate your users, but only when it is required Summary
53. Let’s discuss Stand K10 @andymarch Slides: speakerdeck.com/andymarch/customers-in-the-crosshairs