With today's challenges of customer identity and access management (CIAM), the road to an improved customer experience is often a bumpy one. Even when it's paved with good intentions.
To make the customer experience faster, easier and more seamless, companies are adopting more social, mobile and cloud technologies than ever before. But in the process, they've also extended the identity boundary of their digital businesses well beyond their traditional security perimeter's control.
For example, let's look at the recent ADP case. In May, the payroll service provider acknowledged that identity thieves had gained access to some of their clients' online portals, compromising the W-2 data of employees at more than a dozen customer firms. One customer firm posted employee identification codes (not authentication codes) online just to make it easier for employees to access their W-2 information. Fraudsters used the data to create unauthorized accounts for employees who had not yet registered on ADP's portal using confidential personal information from other sources. A letter to employees also warned that the stolen tax and salary data may have been used to file a fraudulent income tax return under the employee's name.
This is just an example of a growing security trend. Thieves are no longer content to steal just credit card information and social security numbers. Savvy cybercriminals have even set their sites on customers' Uber, PayPal and Netflix accounts. These accounts have become more valuable to thieves for the price they can fetch in the cyber underground, where criminals are able to use the stolen information to build a fuller picture of a victim for identity theft later.
According to Verizon's 2016 Data Breach Investigations Report, web app attacks are also a top vulnerability concern for companies. The report states that 95% of all breaches and 86% of incidents can be traced to nine patterns, including web app attacks where hackers find vulnerabilities in an app or an ecommerce platform. Some 95% of web app attacks were financially motivated, according to the study. Verizon recommends two-factor authentication as one solution to the problem.
The reality of CIAM is that traditional tools were built to manage employee access to on-premises applications. So as consumers increasingly make purchases online from new devices and applications, the companies they do business with are tasked with a whole new set of IAM challenges.
CIAM requires greater scalability and different functionality than traditional IAM, as well as unparalleled usability and support for seamless multi-channel interactions. This means that an integrated infrastructure is a must--a standards-based CIAM solution that offers services like SSO, scalable access, centralized control and multi-factor authentication, along with a unified view of the customer.
Just as the requirements of enterprise IAM and CIAM are different, so is the approach to defining and implementing a solution. Take a look at our 5-minute reference guide to learn more about key considerations when solving CIAM challenges.