5 Trends to Watch in Customer Identity

Customer identity is becoming increasingly sophisticated. Customers expect a seamless login, intuitive navigation, and to be protected. In order to keep up with these rapid changes, organizations need to pay close attention to developments and innovations affecting customer identity systems. And more importantly, be ready to implement new products and solutions quickly and efficiently. 

So you can be at the top of your game, here are five trends to watch in customer identity for the next year:

Nowadays, we are seeing more and more organizations across multiple industries–implementing risk-based authentication (RBA) systems that take in risk signals prior to granting access to the user. 

Some of the risk signals that they’re looking out for include:

• Device posture: Is it the same device that the person has been logging in with historically? Has it been jailbroken? 

• Network data: Are they logging in from the same network, or is this a new network? Is it within the IP range? 

• User inputs: Does the user interact with the device in a normal pattern, including speed of typing, what is pressed on screen, how hard they press, and how quickly they are swiping across the screen?

Since one of the main components of RBA is detecting fraudulent activity before the session begins, the best fraud prevention tools begin to work prior to the user authenticated session. This means that as soon as a user lands on the page, fraud detection goes to work evaluating all the risk signals it can, analyzing the available telemetry and user data, and correlating it with third-party data to determine if it is a legitimate user or a bot. 

 ◻︎ Check: Are you implementing continuous RBA?

Another trend in customer identity is that many organizations are moving from static, role-based access control (RBAC) to attribute-based access control (ABAC), or dynamic authorization. Historically, organizations have relied on static authorization based on a user giving all of their data to a company and assigning a role to them. In today’s broader digital world, much more needs to be evaluated in order to make high-value authorization decisions, such as transferring money.

What is dynamic authorization? It gives you one centralized place to control authorization and can evaluate all the attributes and telemetry available for a given user. This is anything from their role, identity attributes, user consent (stored in a database or user directory), member statuses, reward points, risk signals, and any other data a company has access to. And it isn’t just limited to authorizing which resources users can access. These policies can also be evaluated to authorize actions, like transactions aprovals, or enforce user consent when sharing a user’s data to third-party apps.

Now, the user can choose what information they want to provide to the organization, based on a specific interaction.  For example, let’s say users are choosing to use a service like Mint to gain a consolidated view of their financial data. In this case, the user can choose to only allow Mint to see basic information, such as their account balances, but nothing about when bills are due.

Another example could be when a user orders an appliance from a retailer and they consent to share their address and phone number with the third-party delivery company, but not their email address.

Organizations who implement dynamic authorization will likely see an increase in consumer loyalty, trust, and overall customer satisfaction since today users want more ownership over their data.

  ◻︎ Check: Have you switched to dynamic authorization?

Today’s data systems are currently centralized, meaning a user’s personal information like name, address, and credit card information could potentially be stored at dozens of sites. 

For instance, in the past, eCommerce companies would store personal details and credit card information of their users. Now, standards are being put in place to allow customers to take back control of their identity data through decentralized identity. This means organizations will only need to receive information on a transactional basis; when users allow their verified credentials and payment method to be securely transmitted from their digital wallet to the organization in order to complete said transaction. 

For example, you can provide your verified credentials at the doctor's office which would eliminate the need for them to confirm your insurance by calling the insurance company to verify your coverage and copay. The standards also ensure that the information is always up-to-date, not a single point-in-time picture of what the data was. And users can revoke the data at any time, giving them full control of their personal data. 

In short, decentralized identity allows users to take control of their information, minimizing the need to permanently surrender their data to one organization just to be able to interact with them. This is also beneficial to businesses, because they can trust that consumer information shared with them is accurate and belongs to the person they are transacting with, thus decreasing fraud and amplifying security for both parties simultaneously.

What are the considerations of decentralized identity?

Decentralized identity has loads of benefits, but these only grow with the number of people who use it. Unfortunately, this has created a chicken-and-egg situation. 

It looks like this:

Today’s banks can easily issue a digital version of a user’s credit card that would be compatible with decentralized identity protocols, this is not all that different from the user adding their credit card into their digital wallet on their phone. 

Taking that concept a step further, state governments can issue you a digital version of your driver's license that you can store on your phone, too. However, you’ll still need to carry your physical license until rental car agencies and your local brewery have the tools to actually verify that digital identity themselves. Momentum is building around decentralized identity, and this trend is not going away. It will fundamentally shift how we–as people–present ourselves in a digital world, and it's only a matter of time before it becomes the norm.

   ◻︎ Check: Do you have a method or plan of decentralized identity in place?

Over the last few years, we have seen security take center stage. The headlines have been riddled with breaches from those that affect our everyday lives such as the crippling ransomware on Colonial Pipeline, to those on healthcare and higher education. 

Now, CISO’s are working closely with CIO’s on digital transformation initiatives to ensure frictionless user experiences are secure. An example of this is the implementation of the risk-based authentication systems (mentioned earlier). After all, why burden every user with multi-factor authentication when not all users pose the same level of risk?

Another way this is coming to life is by eliminating passwords, creating secure and seamless login experiences for users that allow organizations to keep their consumer base strong and stay ahead of their competitors. More on this in a bit.

Ultimately, we have seen growing interest in the ability to rapidly create, test, and evaluate user experiences to uncover what is working best. This means: 

• Easy to embed experiences into apps with a simple copy and paste of a few lines of code. The stuff you embed will automatically inherit app styles and looks beautiful, making time to market a fraction of what it is today.

• Orchestrating user experiences across the entire user journey, not just at authentication. Before registration, after authentication, and beyond. This also allows you to create holistic business dashboards across the entire user journey. 

• A/B testing and analytics to be able to test and analyze which user journeys convert more users in order to quickly optimize for the best experience.
  
  

• Make it Easy for Developers by making the implementation of experiences into the applications as easy as designing them. For example, getting a seamless registration flow into an app with a few lines of code, having it automatically inherit the app’s design and styles, and being able to instantly update it with a drag and drop interface. 

 ◻︎ Check: Are you prioritizing your users’ experience?

Finally–and, though we’re not quite there yet–one of the trends we’re seeing in CIAM is that more organizations will be offering passwordless authentication. But this is a journey that organizations need to take. And, like many things, the reason they might not be there yet is because of competing priorities for resources to make this change or they could simply be unclear about what the first steps to take are.

All this being considered, don’t keep passwordless authentication on the backburner for too long As the benefits are enormous! Here’s why:

• Passwordless significantly improves user experience by making online access seamless and secure. 46% of consumers prefer sites that offer alternatives to passwords and 53% feel better when using MFA to sign into sites or services. 
  
  

  Customers are already familiar with passwordless biometric logins on their smartphones. By offering passwordless authentication, businesses can not only improve customer experiences, but also reduce abandonment rates and improve their bottom lines.

   

• 33% of helpdesk tickets are related to passwords, and in the past year, IT leaders have seen a 30% increase in password-related incidents.¹

• When it comes to employee identities, passwords are very expensive for organizations. On average, 11 hours are lost annually from password resets, 12 minutes are spent daily entering and resetting passwords, and 33% of IT department’s tickets are related to passwords. For a company of 15,000 employees, the estimated cost of lost productivity per organization averaging $5.2 million annually.²

While passwordless is a journey, it’s a win-win for both the company and customers.

 ◻︎ Check: Have you started a passwordless project?

Knowing about and staying ahead of these trends is imperative for IT leaders, architects, and practitioners. Knowing where you currently stand helps you better understand where you want to be. Smart organizations should continue to aim for improving their approach to CIAM as much as possible, if and when budgets and resources allow.

Let’s do a quick recap:

 ◻︎ Are you implementing continuous RBA?

 ◻︎ Have you switched to dynamic authorization?

 ◻︎ Do you have a method or plan of decentralized identity in place?

 ◻︎ Are you prioritizing your users’ experience?

 ◻︎ Have you started a passwordless project? 

Don’t worry if you can’t check these all off. Generally, as long as you’re keeping security and the customer experience in mind, you’re in the right place.

Check out our more comprehensive CIAM buyer’s guide for a detailed roadmap of how to evaluate a customer identity solution. 

Sources:

1. Our Passwordless Future: A new era of security https://www.pingidentity.com/en/resources/content-library/misc/3637-2022-workforce-survey-our-passwordless-future.html

2. https://www.thenationalnews.com/business/up-to-11-hours-spent-every-year-resetting-passwords-1.819620