Saving Face: How Biometrics and Step-Up Authentication Safeguard Data in the Digital Age

by Ralph Rodriguez

Ralph Rodriguez

President & Chief Product Officer

• 
• 

Ralph A. Rodriguez is President, Chief Product Officer (CPO), and a member of the Board of Directors for Daon. He is accountable for defining the go-to-market vision, strategy, and roadmaps for Daon’s products and technology.

Ralph was most recently an Executive-in-Residence at Summit Partners, a Boston-based private equity firm. Previously he was a Research Scientist and Head of Identity Verification at Facebook, where he oversaw Applied Identity Intelligence. Ralph was also the co-founder and chief technology officer of Confirm.io, an identity verification and authentication company acquired by Facebook in March 2018. Ralph founded Blue Hill Research, Delfigo Security, Invenio, and NTA before Confirm.io. In addition, he was the CTO/CIO of public companies Brooks Automation (NASDAQ: BRKS), C-bridge Internet Solutions (NASDAQ: CBIS), and Excelon Corporation (NASDAQ: EXLN).

As the longest-serving Fellow at the Massachusetts Institute of Technology (MIT), Ralph pioneered research on artificial intelligence (AI), cloud, mobile, neural science, and security technologies at the MIT Media Lab and Harvard-MIT Health Sciences and Technology (HST) departments.

Ralph studied for an Sc.D. in information systems and is a graduate of the management program GPMD-MBA at IESE Business School, Barcelona, Spain. He served in the United States Army during the Persian Gulf War in 1990 and was named Soldier of the Year by the 10th Mountain Division (Light Infantry) in 1987. Ralph has 23 US patents and international patent applications.

November 1, 2023

In today’s dynamic digital cosmos, ever-intensifying concern over data breaches and cyberattacks casts dark shadows over online interactions. As leaders guide businesses through e-banking revolutions, a boom in esports excitement, and the digital transformation of travel experiences, the responsibility to protect user data takes center stage – and passwords alone are completely insufficient. The modern business vanguard now relies on cutting-edge solutions to ensure impenetrable security.

Biometrics, with facial recognition at the forefront, is the pinnacle of security technology’s evolution. Face recognition, when combined with step-up authentication, provides an identity assurance paradigm that is not only resilient, but futureproof. For executives in industries like banking, telecommunications, gaming, esports, and travel, especially, embracing next-gen authentication is more than simply a strategic move: it’s an executive mandate to strengthen trust in the digital age.

Understanding step-up authentication

It is critical to understand step-up authentication before delving into the power of biometrics. Step-up authentication is, at its heart, a multi-layered security procedure that introduces additional authentication methods for high-risk behaviors. This technique, rather than providing a single, static security wall, is dynamic and adjusts based on the level of perceived risk. Consider a security system that is calm when you check your bank balance, for example, but becomes hypervigilant when a large transfer request is made; step-up authentication protects from atypical account access or transactions, and from wide forms of fraud.

Types of step-up authentication and their use cases

• Basic to Multi-Factor Authentication (MFA)

Initial Access: User logs into a platform using a simple username and password.

Step-Up Scenario: When the same user attempts a sensitive action, like changing account settings or initiating a financial transaction, they’re prompted to provide an additional authentication factor like an SMS code (knowledge-based authentication factor, or KBA) or a fingerprint (biometric factor).

• Soft Tokens to Hard Tokens

Initial Access: User accesses a system using a soft token, such as a code generated by an app on their smartphone.

Step-Up Scenario: For certain high-security operations, a hard token (physical device, e.g., a smart card or a hardware key) might be required.

• Passwords to Biometric Verification

Initial Access: User logs in using a traditional password.

Step-Up Scenario: When attempting to access a highly secure dataset or operation, biometric verification, via facial recognition or fingerprint scanning, is demanded.

• Geolocation and Behavior-Based Authentication

Initial Access: User accesses their account normally.

Step-Up Scenario: If the user logs in from a new or unusual location, or exhibits behavior divergent from their established usage patterns, they might be asked to confirm their identity via an additional method.

• Device Recognition

Initial Access: User logs in from a recognized device without additional verification.

Step-Up Scenario: If the system detects a login attempt from an unrecognized device, it prompts additional authentication, such as entering a verification code that’s sent to a user’s registered email.

• Time-Based Restrictions

Initial Access: User accesses the system during regular hours without additional verification.

Step-Up Scenario: Access attempts during off-hours or unusual times might require additional verification steps.

• Risk or Value-Based Authentication

Initial Access: User checks account balance on a banking platform without added verification.

Step-Up Scenario: If the user tries to transfer a large sum of money, the system prompts for another layer of authentication.

Step-up authentication adapts to the perceived risk level associated with a user’s activity. By adding layers of security only when required, it strikes a balance between user convenience and robust security, ensuring that more sensitive actions are adequately protected without burdening users during less risky operations. This approach is especially important in industries like banking, e-commerce, and healthcare, where varying levels of sensitivity across operations demand dynamic authentication solutions.

Biometrics: the executive’s best bet against security threats

In the high-stakes realm of cybersecurity, biometrics stands out as an innovative solution, distinguishing users not by what they know, but by who they are. Rooted in the recognition of idiosyncratic physical or behavioral attributes, biometrics technology ushers in an era where the essence of individuality becomes the keystone of digital security.

Biometrics are immune to the types of fraud that passwords and other knowledge-based authentication factors are vulnerable to: phishing, social engineering, man-in-the-middle, and other kinds of attacks. Biometric authentication is simple for customers and employees, only requiring them to, for example, press their fingerprint to a scanner or take a selfie. There’s nothing to remember, nothing that can be lost, and no other items necessary for the user to have in their possession. In addition, organizations looking to implement biometrics don’t need to make any investments in fancy tech: every smartphone with a camera that is widely available today has the high-res optimization and image quality necessary for a user to capture a facial biometric.

Facial recognition has staked its claim as the gold standard of biometric methods. Its universality, fused with unparalleled consistency and the promise of unobtrusive verification, lends it an edge that resonates with everyone – from the average user to the executive suite. Technology industry leaps in artificial intelligence and machine learning have honed the precision of facial recognition systems, amplifying their popularity.

Here’s why facial recognition stands out
Universality and stability: Faces are universal and, barring drastic changes, remain consistent throughout adulthood.

User-friendliness: Users don’t need to be in close contact with a device, making the facial recognition experience seamless. This also allays any post-pandemic concerns about shared contact with devices and ensures all users feel safe to take advantage of the convenience of biometrics.

Technological advancements: With AI, the margin for error in facial recognition has significantly reduced, ensuring minimal false positives.

The power of biometrics across industries

In industries where the margin for mistakes is razor-thin, combining biometric technologies with step-up authentication is not only a strategic advantage, but a necessary cornerstone of modern identity security. The digital battlefield is continuously shifting, with fraudsters constantly recalibrating their strategy. As a result, our defenses cannot be static.

Banking and Financial Services
Traditional passwords are no longer acceptable in the high stakes financial services industry. Users seek and regulators require increased security, particularly for essential transactions. Banks can provide this additional degree of security by incorporating facial recognition. For example, while routine online banking activities may only require a password, major transactions may necessitate a facial scan request to ensure that the action is being initiated by a genuine account holder.

Telecommunications
With our phone numbers and mobile devices tied to myriad services, ensuring the legitimate owner is making changes or obtaining a new physical or e-SIM card is crucial. Using facial recognition, telecom operators can deter SIM-swap frauds and unauthorized account access.

Gaming and esports
The gaming industry has evolved from pure entertainment to offering lucrative in-game assets and real-money transactions. Integrating face recognition ensures that high-value transactions or updates are made by the authentic account owner. Furthermore, it gives confirmation of the genuine gamer, ensuring that the opposing player is not being gamed.

Travel Sector
In the travel and hospitality industry, time and customer service is always of the essence. Instead of various documents and friction-filled confirmation processes, travelers can utilize a simple face scan to verify their identity. Facial recognition optimizes travel processes, improving user experience and confirming that the traveler’s identity matches the ticket or reservation data.

The convergence of biometrics and step-up authentication

While biometrics provides an additional layer of security, integrating it with step-up authentication takes security to the next level. Traditional methods may be sufficient for routine tasks, but once an action is flagged as high-risk, biometric verification, such as a facial scan, can (and should) be used. Here’s what this winning combination has to offer.

Fortified security
Even if an initial barrier, like a password, is breached, the user’s unique biometric data acts as a formidable second line of defense.

Enhanced user experience
By eliminating the need for users to remember multiple, complex passwords, and by offering a quick biometric check, onboarding, transaction, and recovery processes are all made more user-friendly.

Trust-building
Users are likely to trust platforms and the brands that use them more when they know that advanced technologies are protecting their data.

Regulatory compliance
Several regulatory bodies are now mandating the integration of biometric solutions, especially in sensitive sectors.

Overcoming potential hurdles
While the integration of facial recognition in step-up authentication offers a plethora of advantages, it’s also essential to address associated concerns. The primary concern is user privacy. How do platforms ensure that the biometric data, which is highly personal, remains protected?

Modern solutions to these concerns include:

• On-device processing: Instead of central servers, biometric data processing can be confined to user devices, ensuring data privacy.
• On-server and in-cloud facial biometrics: A primary strategy companies can employ is decentralized storage, where biometric data is not housed in a singular repository but rather is distributed across several secure points, reducing data vulnerability.
• Advanced data encryption: In situations where data needs to be stored, state-of-the-art encryption ensures that it remains inaccessible to unauthorized entities.

Why are step-up authentication and biometrics the future of digital identity?

The pursuit of unwavering security and uncompromising user experience has ushered in technologies that transcend traditional limits in an ever-expanding digital arena. The explanation is straightforward: a normal password, no matter how difficult, is no longer the barrier it once was against today’s dedicated and increasingly savvy hackers.

It’s not just a matter of raising the fortress walls; it’s also a matter of making the fortress impenetrable. A hacker may beat a password, but reproducing unique biometric data remains a hard issue, especially in the face of sophisticated liveness detection tools. Biometric technology is an organization’s best defense against cybercriminals.

Beyond security, the convenience of a glance or a fingerprint scan far outcompetes the mental acrobatics required to remember the hundreds of complex passwords the majority of users have today. Biometrics is a huge victory for user experience. The interfaces of biometric systems increase user confidence and encourage deeper involvement with digital platforms. Furthermore, regulatory organizations’ clarion calls for biometric integration highlight the technology’s significance, particularly in areas where data sensitivity is important.

As we look at what’s next for cybersecurity, the beacon is clear: biometrics, embedded in enhanced authentication, is not only the future – it’s already the present. Combining biometrics with enhanced authentication is about more than just keeping up; it’s about setting the pace and defining a road that assures our digital efforts stay both limitless and secure.

Learn more about xAuth, Daon’s advanced biometric MFA product, here.