Ultimate Guide to Customer Identity and Access Management (CIAM)
1 - It's Still All About Customer Experience
2 - Customer Experience: What Your Customers Really Want
3 - Customer Identity: Delivering the Experience Your Customers Expect
2 - Customer Experience: What Your Customers Really Want
Managing the customer experience across the entire journey can feel like a tall order. But what your customers really want is simple:
- Delight me
- Protect and respect me
Things like registration and sign-on are a necessary part of a digital customer experience. But they aren’t the parts your customers enjoy, and that’s all the more reason to make them as seamless and convenient as possible.
If you make these initial interactions too cumbersome, you run the very real risk of driving customers away. But when you provide simple and secure access, it’s like rolling out a virtual red carpet that invites them in. This is the type of CX that delights your customers and paves the way for increased engagement.
Multi-channel: Don't Make Me Tell You Twice
The channels through which you deliver customer experience have become increasingly complex as digital tools have evolved. But at the end of the day, your customers want good old-fashioned customer service. They want that feeling you get when you walk into your local coffee shop and the barista greets you by name and has your drink almost made by the time you get to the counter.
Said another way, your customers expect to be able to communicate something once and have you remember it. This means if a customer changes their name on their checking account, they expect you to make the change on their associated savings and investment accounts as well. Similarly, if a customer updates their preferences to opt-out of emails on your mobile application, they expect that your web application doesn’t email them either. Sure, these functions may be managed by separate teams within your organization or external third parties, but your customers don’t know this, nor do they care.
Learn more about delivering seamless multi-channel experiences.
A 2019 survey of more than 4,000 consumers in the U.S., UK, Australia, France and Germany found that 37% of customers must change a password at least monthly because of account lockout.
Frictionless: Don't Make Things Harder than Needed
When you’re unable to deliver the consistency customers want, you introduce friction. Friction can be anything that impedes a customer along their journey, from small annoyances to bigger disconnects. A classic example is complicated password policies.
In an attempt to maintain security, some organizations require users to create very long passwords that contain specific combinations of capital letters, numbers, and symbols. This is an area where a balance between convenience and security is critical. If policies are unnecessarily complex it can be difficult to come up with a password initially, let alone enter it twice without making a mistake.
Remembering these intricate passwords is just as difficult, leaving many customers in the position of having to reset their forgotten passwords every time they log in. Expecting that your customers will continue this dance is unrealistic. More likely, they’ll abandon your brand in favor of organizations that offer a smoother experience.
Are your authentication methods driving customers away?
Discover 5 common authentication mistakes—and how to fix them.
Fast: Don't Waste My Time
Poor experiences like complicated password requirements aren’t just frustrating, they take too much time. Like Mr. Vain in the ‘90s song by Culture Beats, your customers know what they want and they want it now. They don’t want to go through additional steps or processes. In cases where security is crucial, such as banking, it's okay to require more from customers. The key is not to require more than is necessary, so you can make access as hassle-free as possible.
Now, you may know what it really takes to deliver that type of experience. But as a gentle reminder, no one comes to your site to see how awesome your registration or sign-on experiences are. In fact, the way you know those experiences are amazing is when they’re so seamless they go completely unnoticed.
Protect & Respect Me
Data security has become a major concern for consumers in recent years. Whether justified or not, your customers are placing the sole responsibility for data protection on you and expect more accountability than ever.
As more and more digital information is gathered about customers, their concept of security has also evolved. Protecting them from breaches and fraud alone isn’t enough. Your customers also expect you to respect their privacy and be good stewards of the data they share with you.
The 2019 Consumer Survey “Trust and Accountability in the Era of Data Misuse” revealed that 81% of customers would limit or completely stop their interactions with a brand following a breach.
Fraud: Don't Put Me at Risk
Our 2019 survey also revealed that 63% of customers believe a company is always responsible for protecting their data. This is regardless of whether they fell victim to a phishing email or did something unsafe like using unencrypted Wi-Fi connections or the same password across accounts. Said another way, most customers will blame you if they fall victim to fraud even if there was little or nothing you could have done to prevent it.
While incidents of fraud don’t make headline news as often as big breaches do, these more narrowly targeted attacks impact the individual much more acutely. And the onus is on you to make sure whoever is requesting access really is who they say they are. Given what’s at risk, usernames and passwords aren’t enough, and any defense you can mount is well worth it.
Learn more about securing customer identity data.
Breaches: Don't Expose My Personal Data
Data breaches are among the most costly events a customer-facing enterprise can experience. A single breach can result in customer abandonment, fines, and brand damage that is nearly impossible to quantify. Our 2019 survey of more than 4,000 customers across the U.S., UK, Australia, France and Germany found that 56% would stop engaging with a brand online following a breach and an additional 25% would stop all interaction whatsoever.
If you’re storing user data, you have the responsibility for protecting that data. That includes ensuring that potential bad actors both from outside as well as within your organization can’t access the keys to the kingdom. Your customers are trusting you to take the security measures needed, no matter what it requires.
Privacy Violations: Don't Disrespect Me
Across industries, customers are skeptical about companies’ ability to protect their privacy. Even as customers increasingly see the value in choosing security over convenience, their top priority is that their privacy be maintained—and respected.
While regulations like GDPR and CCPA further support this expectation, they also provide an opportunity to demonstrate this respect. It’s all too easy to see compliance as just another hurdle to overcome. But when you give customers transparent insight into and control over the personal data you’ve gathered about them, you’re also giving them the respect they expect and in doing so earning their trust.
Learn more about building customer trust with privacy and consent.
Balancing Convenience, Security and Privacy
Customers value security, convenience and privacy. There is no perfect balance. The ideal mix will vary from organization to organization. Finding the mix that’s right for you is a tall order, but customer identity helps you develop a plan that considers which conveniences are imperative, what risks you’re willing to accept, and ensure compliance with privacy regulations.
5 Ways to Defend Customer Data in the Digital Age
Given the many threats today’s enterprises face, building a strong defense is a must. But some days it feels like a battle you can’t win. Protecting customer data against breaches and fraud adds another layer of complexity to an already huge responsibility—and it requires different methods. These five tactics will help you mount a strong defense.
- Implement Customer MFA
Customer multi-factor authentication provides a greater level of assurance that the user accessing an app is actually your customer, not someone who successfully phished them. Should access be attempted with a stolen username and password, the customer will be prompted on their trusted device to complete authentication. This alerts the customer their credentials have been compromised and in doing so can thwart the attack.
- Control Access to Your APIs
While APIs are driving digital transformation, they’re also attractive targets for hackers and rogue insiders. You can protect against common gaps in API security by securing access to your APIs and restricting access to only the data that’s needed.
- Encrypt Data
To protect customer information, you need a secure place to store their data. But you also need the ability to protect data while in use and in motion. Enforcing data encryption allows you to protect data at all times so if it does end up in the wrong hands, it’s unusable.
- Implement Workforce MFA
The 2019 Verizon Data Breach Investigations Report found that 34% of data breaches were inside attacks, whether innocent or intentional. Modern workforce multi-factor authentication gives you the added assurance that users are who they say they are, wherever, whenever and however they need access to company resources like customer data and other sensitive resources.
- Monitor Administrative Activity
Breaches are often executed over time and can remain undetected for months or even years while customer data is slowly siphoned. By applying preventative controls like limiting the number of identities an administrator can download, tracking when logs are changed or creating alerts for other admin account escalations—you can effectively monitor suspicious activity and prevent attacks.
