Frictionless security is now clever enough

Tallen Harmsen, head of cyber security at IndigoCube

An example of frictionless security is using your smart phone’s biometric reader or facial recognition to sign into your banking app or a retail website. It’s frictionless because you can sign into the retail website and buy whatever you need with the swipe or click of a single button.

Businesses need frictionless security. Most notably the customer experience suffers when people have to slow down the process of signing in to access the service every time by entering a username and password. A lot of people use their browser’s automatic “remember password” function but that’s not always secure.

There are other areas where frictionless security is also a major boon. Merged or consolidated businesses. Large organisations with multiple business units, divisions, and data sources. In fact, any size organisation accessing a multitude of system, services, or functions.

A more fluid service

You can deliver a much more fluid service if the security becomes unobtrusive without having to log in to each and every single system or microservice. That’s why a lot of organisations use facial recognition for their apps on newer devices. But not everyone has facial recognition on their device and businesses cannot necessarily trust that user devices are secured.

Multi-layered, frictionless security can also have multiple layers of security intelligently co-operate with one another. Hackers may circumvent one but another will catch their actions and stop them.

Advances in machine learning have made it possible for the algorithms to intelligently learn the typical behaviours of people and systems. The algorithms can link those back to more traditional accessibility functions and get intelligence from HR records, for example. They can then intelligently monitor, unobtrusively, to interject only when something’s amiss.

At that point, they can take any of a number of actions. They can continue to simply monitor. Or they can score activities that, once cumulatively surpassing pre-set limits, can alert necessary people. Or they can lock systems down entirely. They can do so, right up to locking down the systems, without hindering the user experience.

It happens at the speed of computing so there’s no phoning or mailing or messaging an administrator to intervene. It happens in nanoseconds. That’s a lot quicker than, say, ransomware code replicating throughout an organisation to lock down systems before any legitimate administrator can respond.

It isolates the problem and secures the systems when there’s a problem but intelligent frictionless security becomes a silent bodyguard standing in the shadows when behaviours are routine.