Risk-Based Authentication Explained

[@rodpedro_]

I really love Jeff Crume's videos, an easy way to learn about cybersecurity and to stay up to date. Keep up the good work!

[@RaptorSLC]

Sensitivity in the context of cybersecurity is a new term for me. I wish you had defined it. I'll look into it. This is an excellent series.

[@RaptorSLC]

Apparently, sensitivity is a synonym for the value of the data. Risk is a broader concept, including all things (like threats) that need to be considered in protecting the data.

[@jeffcrume]

@@RaptorSLCyes, sensitivity refers to how potentially damaging the data could be if it were to be compromised.

[@moonpy9191]

Fantastic insights on user behavior risk factors affecting MFA systems! This explanation goes above and beyond. As someone who has completed cybersecurity training, this was eye-opening. IBM’ influencers at the forefront of enterprise tutorial!

[@jeffcrume]

Thanks so much for all the kind compliments!

[@RezaShaikhly]

So coherent and intuitive, basics of authentication explained thoroughly, thank you! What we are, what we know and what we have... isn't this familiar even in real life and not just cyber world? :)

[@jeffcrume]

I’m glad you liked it. I think your point is right to a great extent, however, I think we tend to rely more on what we are (voice, appearance, etc.) to recognize each other

[@pankaj16octdogra]

Superb explanation

[@jeffcrume]

Thanks!

[@toenytv7946]

I aggree with the step up. This is a hard challenge. Im thinking ml or a selection of a choice like a bunch of shapes to select or even 1 to verify, an emoji maybe? A hand? My car key? Yeah that would be a step up. Thanks Jeff. Feel the love for a very sensitive risk concern in this video. Great breakdown of what could be done and who,when,where,why? Just the how stumps me. Like to see more on IAM❤IBM. Hope the hashicorp has something to add to this mix.

[@jeffcrume]

Thanks for the great feedback! Authentication is a hard problem, for sure. The good news is that we've come a long way from just userid/password as the only option. Definitely more work to be done, though ...

[@nanke1987]

Isn't geolocation hard to test for with the use of VPN? Turning the VPN on and off to because some tools or features need it might make it look like impossible travel, right?

[@jeffcrume]

Yes, on all counts. Which is why I would only use it as one of the factors considered. In fact, they all have weaknesses but, when combined, they look a lot better

[@joymakerRC]

thanks bro , super informative.

[@jeffcrume]

Glad you liked it!

[@RohitJagadale-y8b]

Best Explanation

[@jeffcrume]

Thanks!

[@blogcorpo]

Excelent ♥♥

[@YvonneMcGinnis]

Who checks the authentication, is it an automated risk-based authentication system, or is a human behind a risk-based authentication system process?

[@jeffcrume]

This would definitely need to be automated in software. No way for a human to keep up with the demand for most systems

[@JoelJosephReji]

Wouldn't VPNs cause cases of impossible travel?

[@jeffcrume]

They could trigger a warning, which is why you shouldn't rely on geo location alone but use it just as one of many factors in making the decision

[@JoelJosephReji]

@@jeffcrume makes sense! Thanks!