Risk-based authentication helps prevent fraud, insider threats, and other attacks by comparing the actions of users to a baseline of normal activity.
After reading this article you will be able to:
Copy article link
Risk-based authentication is an approach to validating user actions beyond confirming their credentials. Risk-based authentication assesses multiple factors in addition to whatever authentication factors users provide to determine if their activities are probably legitimate or are likely those of an attacker or a scammer. This security measure is especially relevant for platforms that are often targeted for financial fraud, such as ecommerce retailers or financial platforms.
Instead of simply confirming that a user has entered the correct password at the start of the session, risk-based authentication might take into account factors like:
While basic authentication is either allow or deny — the user either logs in or they do not — risk-based authentication weighs all these factors to create a risk score. Once the risk score passes a certain threshold, a user action might trigger an additional challenge to further validate their identity. Past a certain point, the user action might be denied altogether.
Attackers often use account takeover to hijack legitimate user accounts and then carry out fraud. Risk-based authentication is a way to verify that users are behaving normally, and therefore less likely to be carrying out fraud, without disturbing the user. Risk-based authentication runs in the background and only prompts the user for additional authentication when necessary.
Imagine these three scenarios:
The first scenario is the least risky. Bob's father can be very sure he is really talking to Bob, his son.
The second scenario introduces some risk. A scammer might be pretending to be Bob over the phone. Bob's father might be reasonably sure he is speaking to Bob, but he might still say, "Let's talk about it more the next time you visit."
The third scenario is the most risky. The person who calls themself Bob is acting differently from Bob and using a different phone number. Bob's father might not even respond to such a request.
Risk-based authentication is an automated way for digital platforms to build in Bob's father's sense of judgment. It automatically sorts out authentic actions from probable scams.
Risk-based authentication continuously monitors user actions. It applies both to user logins and to actions taken after user logins. It uses risk signals to calculate a risk score, which is then used to determine if the user should provide additional authentication or should be blocked from carrying out their attempted action altogether.
Risk-based authentication tracks data points like:
All of these can be risk signals. Some — such as device reputation — are more cut-and-dried: if a device has been known to participate in attacks or fraud in the past, actions originating from that device can be considered extremely risky.
Others rely on comparing current factors against a baseline: for instance, the time of day does not indicate much in and of itself, but if a user is accessing their account at a highly unusual time for them (at three in the morning, for instance) that can be a risk signal, though its strength can vary. If Alice works at her job from 9 AM to 5 PM, a login at 6 PM could be a slight risk signal, while Alice logging in at 11 PM could be a somewhat stronger risk signal. Machine learning is used to compare these data points against each other and detect deviations from the norm.
For data points like IP reputation and device reputation, risk-based authentication platforms often rely on third-party threat intelligence feeds. This aids them in, for example, identifying unknown IP addresses that have been associated with fraud in the past.
The risk signals are tracked and combined into a risk score. An action like Alice logging into an application from a new device but from a familiar location and at a typical time might receive a medium risk score. Alice logging into an application from a new device and on the other side of the world might receive a high risk score.
If the risk score exceeds a certain threshold, then a few possible things can happen:
For an elevated risk score, risk-based authentication might prompt the user to provide an additional authentication factor to log in or to perform certain actions. Users might have to authenticate using a factor they had not provided at login, such as using a hard key or providing biometric authentication. Or, they might have to provide another instance of a previously used authentication factor — tapping a hard key again, or answering security questions when they had previously entered a password. (The former is usually more secure.)
Cloudflare One allows organizations to incorporate User Risk Scores directly into their zero trust network access (ZTNA) policies. User access can be adjusted based on the risk they pose to the business, helping to stop insider threats, fraud, and other attacks. Explore how User Risk Scoring works.