Everyone knows that a layered approach to security is needed to protect your business. But how do you maintain strong security for both your business and the consumer while delivering authentication that your customers actually like to use? It’s never been easier to increase security without sacrificing the user experience. Did you know that before you employ multifactor authentication (MFA) that you can easily do a device check that gives you insight to the risk associated with a device? A device risk insight check should be your first line of defense, allowing you to quickly authenticate trusted customers while stopping cyber-criminals. It is instantaneous and allows your business to see if the device being used has been associated with fraud or other risky behaviors. In this webinar we will discuss: * The elements needed for an effective device insight risk check * How MFA and device risk insight checks work together * Best practices for MFA and risk checks throughout the customer journey Join us to learn how as cyber-criminals begin to widen their net, you can leverage risk-based multifactor authentication to improve the customer experience without compromising security.

1. WEBINAR
DOES THIS DEVICE SMELL FISHY?
HOW DEVICE INSIGHT IMPROVES MFA
OCTOBER 2017
MICHAEL THELANDER / SR DIRECTOR PRODUCT MARKETING

2. 2
YOUR HOST
M I C H A E L T H E L A N D E R , D I R E C T O R P R O D U C T M K T G
n Michael’s articles have appeared in IT Professional
Magazine, CyberDefense Magazine, SoftwareCEO .com
n 25 years in product management and product marketing,
with the last 10 focused on cyber security
n Currently drives market and customer research initiatives
n Responsible for new product introductions and training
n Facilitates the ongoing relationship between engineering,
product management, and our iovation subscribers

3. AGENDA
3
THE PROMISED LAND OF MFA
DEVICE RISK AND INSIGHT
PUTTING THEM TOGETHER
TAKEAWAYS

4. THE PROMISED LAND
MULTIFACTOR AUTHENTICATION MATURES

5. 5

6. 6
MOBILE MULTIFACTOR AUTHENTICATION
S T R O N G A N D F L E X I B L E A U T H E N T I C A T I O N
Something you
KNOW

7. 7
MOBILE MULTIFACTOR AUTHENTICATION
S T R O N G A N D F L E X I B L E A U T H E N T I C A T I O N
Something you
KNOW
Something you
ARE
Identity
verified

8. 8
MOBILE MULTIFACTOR AUTHENTICATION
S T R O N G A N D F L E X I B L E A U T H E N T I C A T I O N
Something you
KNOW
Something you
ARE
Something you
HAVE

9. 9
MOBILE MULTIFACTOR AUTHENTICATION
S T R O N G A N D F L E X I B L E A U T H E N T I C A T I O N
Identity
verified
+ +

10. 10
MOBILE MULTIFACTOR AUTHENTICATION
S T R O N G A N D F L E X I B L E A U T H E N T I C A T I O N

11. DEVICE RISK
AND INSIGHT
INVISIBLE ASSURANCE

12. 12
DIFFERENT RULES FOR AUTHENTICATION & RISK
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
NO RISK DETECTED

13. 13
THE DNA OF A DEVICE
HUNDREDS OF DEVICE ATTRIBUTES COMBINE TO CREATE A DIGITAL FINGERPRINT

14. 14
n WiFi (or Bluetooth) MAC Address
n Network configuration
n iOS Device Model
n Battery level / AC mode
n Device orientation
n File system size
n Physical memory
n Number attached accessories
n Has proximity sensor?
n Screen brightness and resolution
n System uptime
n iOS Device Name (MD5 Hash)
n OS Name and/or version
n Device advertising UUID
n Kernel version
n iCloud Ubiquity Token
n Application Vendor UUID /name/vers
n Is Simulator?
THE DNA OF A DEVICE
HUNDREDS OF DEVICE ATTRIBUTES COMBINE TO CREATE A DIGITAL FINGERPRINT
n Locale language / currency code
n WiFi MAC Address
n Bluetooth MAC Address
n Network configuration
n Is plugged in?
n Device orientation
n File system size
n Physical memory
n CPU Type
n CPU count
n CPU Speed
n Screen brightness
n Screen resolution
n System uptime
n iOS Device Name (MD5 Hash)
n Device advertising UUID
n Current latitude
n Current longitude
n Current altitude
n Application Vendor UUID
n Bundle ID
n Application Version
n Application name
n Process name
n Executable name
n Application orientation
n Locale language code
n Locale currency code
n Are location services enabled?
n Time zone
n Currently registered radio
technology
n Carrier name
n Carrier ISO country code
n Carrier mobile country code
n Carrier mobile network code
n Does carrier allow VOIP?
Unique adaptive analytics are used to determine the combinations of
attributes needed to achieve accurate device and risk recognition.

15. 15
DIFFERENT RULES FOR AUTHENTICATION & RISK
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
SLIGHT RISK DETECTED

16. 16
DIFFERENT RULES FOR AUTHENTICATION & RISK
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
MODERATE RISKS DETECTED

17. 17
DIFFERENT RULES FOR AUTHENTICATION & RISK
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
RISK LEVELS EXCEEDED – DENY OR STEP-UP

18. 18
CLEARKEY
D E V I C E - B A S E D A U T H E N T I C A T I O N U S I N G M A C H I N E L E A R N I N G
Machine learning compares returning devices
Transparent authentication eliminates friction
Turns the user’s device into a possession factor
Adaptive, contextual response drives subsequent
authentication strategies and actions
MINIMUM
THRESHOLD
MAXIMUM
THRESHOLD
Original
Device Print
Returning
Device Print

19. 19
CLEARKEY
A N E N G I N E F O R C O N T E X T A N D R I S K
DEVICE ID
GEO LOCATION
DEVICE INTEGRITY
ADDITIONAL
DEVICE CONTEXT
ASSOCIATIONS &
REPUTATION
USER 1 ACCESS
Globally unique identifier for this device
Detect for rooted, jailbroken, compromised
What does iovation know about this device?
Session risk? TOR browser or emulator?
Geo and IP information with anomaly detection

20. PUTTING THEM
TOGETHER
ADDING DEVICE INSIGHT TO MFA WORKFLOWS

21. 21
F R A U D F O R C E N E W Y O R K
DEVICE ID
GEO LOCATION
DEVICE INTEGRITY
ADDITIONAL
DEVICE CONTEXT
ASSOCIATIONS &
REPUTATION

22. 22

23. 23
DEVICE ID
GEO LOCATION
DEVICE INTEGRITY
ADDITIONAL
DEVICE CONTEXT
ASSOCIATIONS &
REPUTATION

24. 24
“Fraud Risk:
Review.”
DEVICE ID
GEO LOCATION
DEVICE INTEGRITY
ADDITIONAL
DEVICE CONTEXT
ASSOCIATIONS &
REPUTATION

25. 25
THE DNA OF A DEVICE
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
NO RISK DETECTED
+1000

26. 26
THE DNA OF A DEVICE
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
SLIGHT RISK DETECTED
+200

27. 27
THE DNA OF A DEVICE
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
MODERATE RISKS DETECTED
-500
+

28. 28
THE DNA OF A DEVICE
EvidenceDevice & Age Risk Profile
Geo-
location
Anomaly Watch ListsVelocity
ISP Watch List
Transactions per
Account
Timezone / Geo
Mismatch
Subscriber
Evidence Exists
Transaction
Amount Range
Geolocation
Mismatch
Device new to
Subscriber
IP Address Range
List
Global Trans
Device Velocity
Device Not
Provided
Evidence Exists
Billing/Shipping
Mismatch
Proxy In Use
New Device,
Existing Acct
Email Domain List
Countries Per Acct
or Device
Suspect Device
Data
IP Address RiskCountry List
Age of the
Association
Browser Language
Trans per
IP/Device/Acct
TOR Exit Node IP
Device Risk
(Local or Global)
Mobile Carrier
Country List
Registered
Acct/Dev Pair
ISP Organization
List
$S Value per
Device or Acct
VM in Use
Language and
Country Risk
IP Address
Distance
Device Type List
Devices per
Account
Mobile Emulator
Detected
Jailbreak/Root
Detected
IP Address
Mismatch
Accts (Created)
per Device
ISP Mismatch
RISK LEVELS EXCEEDED – DENY OR STEP-UP
-1,000
Call
Customer
Service

29. TAKEAWAYS

30. 30
RISK MITIGATION
FraudForce
Real time fraud prevention based
on world class device intelligence.
ClearKey
Transparent device-based authentication for
outstanding user experience.
DEVICE-BASED AUTHENTICATION
TRUST INSIGHT
SureScore
Machine learning identifies valuable customers,
reduces review and accelerates revenue.
MULTIFACTOR AUTHENTICATION
LaunchKey
On-demand multifactor authentication that’s
strong, usable, and fully customizable.

31. 31

32. 32
iovation.com/dummies
Go to
to register for a free copy!

33. Q&A

34. CONTACT US
www.iovation.com
@TheOtherMichael
SENIOR DIRECTOR OF PRODUCT MARKETING
MICHAEL THELANDER
michael.thelander@iovation.com