Webinar: Three Steps to Transform Your Mobile App into a Security Factor

THREE STEPS TO
TRANSFORM YOUR
MOBILE APP INTO A
SECURITY FACTOR
August, 2017
1 Copyright ©2017 Ping Identity Corporation. All rights reserved.

SECURE & CONVENIENT INTERACTIONS
Customer Security
Two-factor authentication is
increasingly important [for CIAM]
Copyright ©2017 Ping Identity Corporation. All rights reserved.2
“
“
Customer Experience
Customers have a low tolerance
for poor user experience
“
“
Security
Customer
Experience

WHAT DOES YOUR APP LOOK LIKE TODAY?
Communication Channel Authentication Flows
A

YOUR APP CAN BE SOMETHING ELSE
…a security factor
§  More secure than SMS
§  Beneﬁts beyond mobile
§  Brand preservation
§  Convenient and secure

CREATING A TRUSTED DEVICE
§  Your app has
access to device
secrets
§  Device secrets
associated with
a user, create a
trusted device
§  Device secrets
are secure
A
******Device Secrets
Your Server
and Database

WHY IS A TRUSTED DEVICE MORE SECURE
than SMS?
SMS text messages
are often the
weakest link in
two-step logins.
~www.wired.com
“ “
An out-of-band secret sent
via SMS is received by an
attacker who has
convinced the mobile
operator to redirect the
victim’s mobile phone to
the attacker.
~National Institute for Standards & Technology
“
“

than SMS?
Credentials Stolen
•  Phishing
•  Brute Force
•  Password Reuse
Number spoofed
SMS intercepted
Off-brand
experience for user
verification
Hacker
authenticated
Credentials verified
Sends credentials
4a
Mobile App
Hosting Server

than Email?
Credentials Stolen
•  Phishing
•  Brute Force
Hacker uses stolen
credentials to
access email
Clunky, multi-step
process for user
veriﬁcation
Hacker
authenticated
Sends credentials
4a
Mobile App
Hosting Server

WHY IS A TRUSTED DEVICE MORE SECURE?
Device Secrets!
Credentials Stolen
•  Phishing
•  Brute Force
Deny
Touch ID for “Your App”
A New Device is Attempting to Login
Seamless, secure
user experience
Device secrets not
veriﬁed
Hacker access
denied
Sends credentials &
device secretsMobile App
Hosting Server

WHAT ABOUT MULTIPLE TRUSTED DEVICES?
Primary Device
Other Trusted Devices
•  Shared Smart Phones
•  Shared Tablets
•  Secondary Devices
Primary Device
Trusted iOS Tablet
Trusted Android Tablet
•  Add New Devices
•  Block Devices
•  Change Primary Device
Delegated Device Admin

UTILIZE YOUR MOBILE APP FOR:
ü  Web authentications
ü  Device-based, mobile
authentications
ü  Transaction approvals
ü  Identity veriﬁcations by CSRs
ü  Password resets
ü  Many more!

TO START: DISCONNECTION
Confidential | Do not distribute — Copyright ©2017 Ping Identity Corporation. All rights reserved.12

TRUSTED DEVICE AS A FACTOR
§  A trusted app on a trusted
device buys you
–  ”something you have”
–  A feedback loop
–  An anchor for trust
§  The user becomes part of the
process
–  Can verify transactions
–  Can notify on fraud
A

THE GOAL

THREE STEPS TO APP AS A FACTOR
1.  Enrollment
–  What is your strategy to
turn on a trusted device
2.  Execution
–  How will you use the
feedback loop
3.  Emergencies
–  What happens when things
go wrong
–  Oﬄine, theft

STEP 1: ENROLLMENT
§  Several models to
choose from:
–  Opt-in in app
–  Opt-in in preferences
–  Required choice of
factors
–  Passive enrollment
›  The default with email
& SMS

STEP 2: EXECUTION
§  Login time:
–  Browser à Device
›  Interaction at web
authentication
–  Device à Device
›  Interaction at app installation
–  Single Device – check for trust
§  Transaction time
–  Purchase
–  Consent
§  Management Time

STEP 3: EMERGENCIES
§  99.99% of the time,
these kinds of security
factors are transparent.
§  0.01% of the time they
are the face of your
organization
§  Plan for the 0.01%

LOST A PASSWORD

ON AN AIRPLANE
Trusted Device not Found
Shopco app
Note: I mocked this up but the underlying functionality exists

LOST DEVICE
21
§  Trusted secondary devices can be promoted

LOST IT ALL
§  Email recovery becomes
the bottom of the sieve
–  SMS is problematic when
coupled with device theft
§  Majority of customers are
able to use self-service
options

SUMMARY
§  Converting your app into a security factor is not
diﬃcult but it takes planning
§  Advantages are huge and the organization has a
lot of control over how the user participates
§  Be sure to spend time on failure cases, but don’t
forget the large population that can navigate in a
completely self-service and secure way

SEE A FULL DEMO OF PINGID
DEMO LINK:
https://www.pingidentity.com/en/resources/client-library/webinars/2017/PingID-sdk-multi-factor-authentication-for-customers.html

Webinar: Three Steps to Transform Your Mobile App into a Security Factor

More Related Content

What's hot

Similar to Webinar: Three Steps to Transform Your Mobile App into a Security Factor

More from Ping Identity

Recently uploaded

Webinar: Three Steps to Transform Your Mobile App into a Security Factor