The Lightweight Directory Access Protocol (LDAP) provides an open-source, cross-platform solution for database access control. LDAP is a common identity and access management (IAM) tool at the enterprise level but can present significant security problems if proper administration protocols aren’t followed. This article offers information to consider potential threats and follow LDAP best practices to better manage risks.

The Basics of LDAP Authentication

User authentication with LDAP works on the basis of a client-server model, in which the client is the system requesting access to information and the server is the LDAP server itself. LDAP servers can store usernames, passwords, attributes and permissions and are often employed to house core user identities for the purpose of IAM.

When users need to access information within a database, they input their credentials and wait for validation. Credentials are compared to the core identities stored in the LDAP database, and authentication occurs if there’s a match. Authenticated credentials grant access to information. If credentials don’t match, authentication doesn’t take place, and users are prevented from interacting with requested data, thus preserving the integrity of the system.

LDAP infrastructure may be housed on the premises of an enterprise or in the cloud. Cloud-based LDAP, or LDAP-as-a-Service, requires no onsite server hardware and is scalable to the needs of individual businesses. Enterprises wishing to use LDAP as a secure authentication method in their IAM protocols can save time, money and maintenance costs by choosing cloud-based LDAP but need to consider and compensate for additional security issues associated with cloud migration.

LDAP Security Concerns to Address

All authentication methods are subject to the risk of unauthorized access. Insider threats are still one of the most common issues facing today’s enterprises, particularly poor password management and phishing attacks. Any action allowing an unauthorized third party to access stored data has the potential to compromise thousands of stored records, including user identities, and can render a previously reliable security protocol worthless before the attack is discovered and stopped.

Hackers may use various types of attacks to undermine LDAP protocols. LDAP injection attacks, similar to SQL injection attacks, involve entering malicious code into fields with the intention of exploiting vulnerabilities in the protocol. When user-submitted data isn’t properly sanitized, it’s possible for hackers to not only gain access to the LDAP database but also modify information within the LDAP tree. In practice, this could allow hackers to access anything within the database, including user identities. Changes to core identity information can lock users out while giving hackers free reign of enterprise data, creating widespread compromise in the system.

A denial-of-service (DoS) attack doesn’t involve unauthorized access but can cripple an enterprise by shutting down legitimate users’ ability to access the LDAP service. Without working LDAP protocols, authentication can’t take place, and users are effectively locked out of critical resources for the duration of the attack.

Directory spoofing is similar to website spoofing, in which hackers redirect connections from legitimate resources to compromised destinations. Directory spoofing involves delivering information appearing to come from the requested database by returning modified data or directing the user to another location. In either case, hackers can obtain credential information and use it to access enterprise databases for the purpose of launching more widespread attacks.

LDAP Best Practices to Manage Authentication

The approach to LDAP management is similar to other IAM protocols and requires adherence to a number of best practices for security measures to be successful:

• Set up automatic provisioning and deprovisioning of user identities
• Never re-use identifiers
• Consider using an enterprise password manager
• Protect passwords during transit with SSL or a similar security protocol
• Use cryptographic hashes to secure stored passwords, and salt the hashes to make them difficult to crack
• Sanitize user inputs to prevent the injection of malicious code and subsequent manipulation of the LDAP database
• Create and enforce access control policies with clearly defined users and objects, as well as rules for database entry creation and modification
• Set up consistent monitoring to identify unauthorized access attempts

Be careful about implementing any controls involving account lockouts, as this may lead to unintentional overloading of the server and denial of service to all users if automatic authentication requests are part of common workflows. Supporting authorized access is part of a robust security protocol and should be taken into account when implementing IAM via LDAP.

Maintaining access control with LDAP can only be successful when accounts are properly managed and security vulnerabilities are addressed. For IT teams executing and managing enterprise IAM protocols using LDAP authentication, the focus must be on data security and integrity. Putting appropriate controls in place and monitoring network activity strengthens defenses against potential attacks and allows LDAP to function as a strong defense against unauthorized access.

Metaverse security certification is critical for staying current with evolving cybersecurity challenges and a way for cybersecurity professionals to demonstrate their knowledge and expertise when offering cybersecurity solutions for virtual environments. Metaverse security certification is a formal recognition that the individual has met a certain level of competency in the unique cybersecurity field and has the skills necessary to protect sensitive information and systems within virtual environments. The Certified Metaverse Security Consultant (CMSC) certification is offered by the Metaverse Security Center at Identity Management Institute. The requirements to obtain the CMSC certification include having a certain level of education, knowledge, and work experience in the metaverse field.

Importance of Metaverse Certification for Security Professionals

Metaverse security certification is important for cybersecurity professionals as it can demonstrate their knowledge and expertise in addressing the unique security challenges of virtual environments. As the metaverse becomes increasingly prevalent and important, having a metaverse security certification can set security professionals apart from others in their field and help them advance in their careers. Additionally, as the metaverse evolves, security professionals with a certification in this area will be better positioned to stay current with new developments and best practices in virtual environment security.

Some important areas of metaverse security training and certification include:

• Virtual environment security: Understanding the unique security challenges of virtual environments and how to protect sensitive information and systems within them.
• Cybersecurity: Knowledge of common cyber threats and how to prevent and mitigate them within a virtual environment.
• Privacy: Understanding how to protect users’ personal information and data within the metaverse.
• Identity and access management: Knowledge of how to authenticate users and control access to virtual environments and assets.
• Network security: Understanding how to secure and protect the infrastructure that supports the metaverse.
• Compliance: Knowledge of relevant regulations and compliance requirements for virtual environments.
• Platform security: Understanding the security features of the metaverse platforms and how to use them effectively.
• Virtual economy security: Knowledge of how to secure virtual economy and financial transactions within the metaverse.
• Incident response and recovery: Understanding how to respond to and recover from security incidents within the metaverse.
• Human factors: Understanding how to design and implement security measures that take into account human behavior and cognitive biases.

Metaverse Security Risk Management

The future for metaverse certification is likely to evolve as the metaverse becomes more prevalent and important. As the metaverse continues to grow in adoption and usage, the need for security professionals with expertise in virtual environments will increase. This will lead to the growing demand for CMSC certification, and a greater emphasis on metaverse-specific security training and certification.

Additionally, as the metaverse continues to evolve and new technologies and applications emerge, the certification requirements and offerings may also change to reflect the latest developments and best practices in virtual environment security.

Also, as the metaverse becomes more mainstream and begins to be used in various industries, it’s possible that regulations and compliance requirements will be developed specifically for the metaverse. This will increase the importance of metaverse-specific CMSC security certification, as it will demonstrate an individual’s knowledge of compliance with niche regulatory requirements.

Overall, the future for metaverse security certification looks promising as it will be an important aspect for security professionals to stay current and relevant in the field as the metaverse becomes more prevalent and important.

Certified Metaverse Security Consultant (CMSC)

Anyone with a Certified Metaverse Security Consultant (CMSC) designation is considered a security professional who has demonstrated their knowledge and expertise in addressing the unique security challenges and considerations of virtual metaverse environments. This certification is awarded to individuals who have met a certain level of competency in the field and have the skills necessary to protect sensitive information and systems within virtual environments.

The role of a CMSC may vary depending on the organization they work for, but some common responsibilities include:

• Assessing and identifying security risks within virtual environments.
• Developing and implementing security strategies to protect virtual environments and the sensitive information and systems within them.
• Monitoring and analyzing security-related data to identify potential threats and vulnerabilities.
• Managing incident response and recovery efforts in the event of a security incident within a virtual environment.
• Advising organizations on compliance with relevant regulations and standards for virtual environments.
• Staying current with new developments and best practices in virtual environment security.
• Providing training and guidance to other security professionals and non-technical staff on security best practices within virtual environments.
• Collaborating with other teams and departments within an organization to ensure the security of virtual environments.
• Providing consulting services to organizations that are looking to implement or improve their security measures in the metaverse.
• Helping organizations to build a security culture in their virtual environments.

It’s important to note that the metaverse is a new and rapidly evolving field, and the certification and training options may change over time, so it is important to stay informed and updated.

Metaverse Certification for Businesses

Security certification can be beneficial for the metaverse as it can help ensure the security and privacy of users’ personal information and data within the virtual environment. Certifications such as ISO 27001 and SOC 2 can demonstrate to users that a metaverse provider has implemented industry-standard security controls and practices to protect their information. Additionally, certifications can also provide assurance to businesses and organizations that may use the metaverse for their operations that their data and systems will be secure within the virtual environment.

Conclusion

Metaverse security certification can be beneficial in demonstrating knowledge and expertise in offering security solutions for virtual environments. Obtaining the CMSC certification can help individuals stand out in a competitive job market and advance in their careers.

As the metaverse becomes more prevalent and important, it’s possible that regulations and compliance requirements will be developed specifically for the metaverse. Hence, metaverse certification for security professionals will become a requirement to demonstrate compliance knowledge with regulatory requirements and the ability to work in the unique metaverse field.

It’s also important to note that some employers and organizations may prefer or even require employees to have metaverse-specific certifications as a way to ensure that they have the necessary knowledge and skills to protect sensitive information and systems within virtual environments.

Data collection and transmission from an increasing number of connected devices requires a secure approach to processing and analysis that edge computing security offers. Edge computing brings these tasks closer to data sources, either enabling execution within devices themselves or outsourcing to local servers and data centers instead of central locations. The basic idea is to minimize data transmission time as much as possible, but increased vulnerability to hackers may be an unwanted side effect of distributing activity across a wider range of endpoints.

Benefits of Computing on the “Edge”

Latency is a problem in use cases where nearly instantaneous transfer of information is necessary. In modern networks, every increment of time counts. A delay of just a fraction of a second may not make a difference when someone asks their smart home speaker for the weather, but the same delay when data is sent to an autonomous vehicle could result in disaster.

Edge computing seeks to solve this problem by:

• Moving the task of initial data processing to connected devices
• Using edge data centers in place of central servers

In traditional network models, connected devices simply collect information and send it to a physical or cloud server, where useless information is weeded out, usable data is analyzed, and instructions are sent back to the devices. This puts a tremendous burden on central servers and creates a repository of data, which could easily attract hackers.

Processing data locally using edge devices and servers distributes power across a network and reduces bandwidth requirements at central locations. With less need for large onsite data centers or extensive server equipment, businesses can reduce power consumption and cut IT costs. Companies providing streaming services and other content to users of connected devices can also benefit by caching data closer to their customers, which allows for faster delivery and a better overall experience.

Security Considerations in Edge Computing

Distributing data across a large network containing numerous devices and data centers operating far from companies’ main locations can create problems with network visibility and control. Each device represents another potentially vulnerable endpoint, and the internet of things (IoT) is notorious for its lack of robust security. Other devices used in edge computing have similar problems: They’re smaller than traditional data center or server setups, not designed with security in mind and aren’t always updated as often as they should be.

Loopholes in edge security can provide hackers easy access to the core of a network. This is of particular concern if edge devices are rushed to market before thorough testing is performed or companies race to adopt the technology without a full understanding of the security risks involved. The smaller size of edge devices also makes them more vulnerable to being stolen or otherwise physically manipulated.

Any network in which edge computing is a major player must be maintained in a unified manner to ensure all devices receive regular updates and proper security protocols are followed. Encryption, patching and the use of artificial intelligence to monitor for, detect and respond to potential threats are all essential, and the responsibility for implementing these security measures falls squarely on companies, not end users.

Can Edge Computing Make Networks Safer?

In an interesting paradox, wider device distribution may offer security benefits. Reducing the distance data has to travel for processing means there are fewer opportunities for trackers to intercept it during transmission. With more data remaining at the edges of the network, central servers are also less likely to become targets for cyberattacks.

The challenge lies in incorporating security into device design. Companies are beginning to focus on this and other measures for making data safer, including the use of encryption and creating solutions to manage, update and secure IoT devices. If inherent security features are built into more end-user devices and edge data centers, it should be possible to create expansive networks with minimal vulnerabilities. However, the technology has not yet reached a point where security can be considered reliable enough to prevent the majority of attacks.

Security agents, devices designed to handle the security measures of which IoT devices are incapable, may provide another solution. This allows security to be undertaken at a network level without sending data all the way to a central server or requiring frequent device upgrades. Security agents are installed near IoT components and function separately to provide the computing power necessary to handle cryptographic security and ensure strong protection against malicious activities.

The potential security perks and drawbacks of edge computing must be considered as IoT becomes more prominent in business environments. Adding devices increases data input, which requires more processing power at the edge, away from onsite and cloud servers. The challenge of protecting remote devices and data centers falls to businesses and device manufacturers, making security a concern from design to deployment.

Deepfake deceptions are fooling people in our expanding and ever-improving digital world. Imagine arriving at work one morning to discover all employees have received an important video announcement from the CEO and are scrambling to comply with the instructions it contains. Their responsiveness would be impressive if not for one thing: The CEO never recorded or sent the video, and now must somehow undo the resulting damage. 

Improvements in artificial technology (AI) and machine learning (ML) is making such flawless deepfake deceptions possible. These fake videos and audios have the potential to undermine security at every level from small businesses to global governments. 

How Deepfake Works

A deepfake is a video or audio made by employing AI and ML to create an exact likeness of a person saying or doing things he or she never actually said or did. The deception plays on the human tendency to believe what is seen and can be very effective in making it appear as though the content of a video is genuine. 

These videos aren’t simply fakes created by hackers skilled in forgery. Deepfakes rely on a form of machine learning in which two networks are fed the same data sets and pitted against each other in a back-and-forth battle of generation and detection. Known as generative adversarial networks (GANs), these systems consist of one network creating fakes and another evaluating the fakes for flaws. The data set consists of hundreds or thousands of images and videos of the person to be imitated, and a forgery is considered good enough when the detection network no longer rejects the results. 

Deepfake Deceptions

Deepfake audio and video involve using AI algorithms to manipulate or synthesize speech or audio to create realistic yet false content. The risks associated with deepfake deceptions include:

1. Misinformation and disinformation: Deepfake can be used to spread false information and manipulate public opinion by making it appear as if someone said something they didn’t.
2. Reputational damage: Deepfake can be used to defame or damage the reputation of individuals by making them appear to say something controversial or damaging.
3. Privacy invasion: Deepfake can be used to invade the privacy of individuals by synthesizing audio content that appears to be of them, but is not.
4. Psychological harm: Deepfake can cause psychological harm to individuals who are portrayed in false or misleading content.

Deepfake has the potential to cause harm and undermine trust in information and media, so it’s important to approach all content with a healthy dose of skepticism.

Artificial Intelligence Factor

Artificial Intelligence is a key component in the creation of deepfakes. AI algorithms are used to analyze and manipulate audio and video content to create realistic yet false depictions of individuals. The following are some ways in which AI contributes to deepfakes:

1. Image and speech synthesis: AI algorithms, such as Generative Adversarial Networks (GANs), are used to generate synthetic images and speech that are almost indistinguishable from the real thing.
2. Face and voice recognition: AI algorithms are used to analyze and manipulate face and voice recognition data to swap the faces or voices of individuals in audio and video content.
3. Machine learning: AI algorithms are trained on large amounts of data to learn patterns in facial movements, speech patterns, and other features that can be used to manipulate audio and video content.

AI plays a critical role in the creation of deepfakes by enabling the creation of realistic and highly convincing false audio and video content. As AI technology continues to advance, the quality and realism of deepfakes is likely to improve, making it even more important to be aware of their potential risks.

Hackers and Malicious AI

When deepfakes first appeared, people mostly used the technology to goof off and create fake pornographic videos. However, the software to produce such videos is readily available to everyday users, making it simple for hackers to employ deepfake tactics and use realistic false content to manipulate their targets. 

Deepfakes are prime candidates for viral status and can spread rapidly across social media. Because fake rumors can take as long as 14 hours to be recognized and debunked, a well-produced deepfake could become entrenched in the public mind as truth long before the deception was detected. Hackers can take advantage of the popularity of viral fakes to spread videos containing malware or record messages designed to entice users to click on links as part of a phishing attack. 

Deepfakes may also be used to draw people to websites in which malicious code has been embedded, turning their computers into tools for mining cryptocurrency. Known as cryptojacking, this kind of attack can also be launched on mobile devices and run undetected in the background as users go about their daily tasks. 

Deepfake Deceptions and Access Control

Deepfake technology is progressing to the point of perfection, and rapid advances in AI and ML mean scenarios like the one described above can no longer be relegated to the realm of science fiction. Using deepfakes, hackers could trick employees into giving away a great deal of information, including access credentials, financial records, tax documents, customer profiles and proprietary company data. 

Because GANs require a significant number of images to create realistic deepfakes, this kind of attack isn’t likely to become the norm overnight. However, the internet in general and social media in particular provides a wealth of pictures and videos posted by users and could theoretically be mined for the data sets necessary to train GANs to produce convincing results. 

Employees tricked by deepfakes or those who indulge in viral videos on company time could easily open the door for hackers to access business networks and fly under the radar or launch large-scale attacks. Such a prevalent threat to access control and compliance requires an updated approach to security. 

How to Identify Deepfakes

Identifying deepfakes can be challenging, as they are designed to look and sound realistic. However, there are some tell-tale signs to look for that can help you determine if an audio or video is a deepfake:

1. Audio-visual inconsistencies: Look for discrepancies between what you hear and what you see in the audio or video. For example, the lips might not match the words being spoken, or the facial expressions might not match the emotions being expressed.
2. Unnatural movements: Look for unnatural movements in the video, such as stiff or jerky movements, or movements that don’t match the audio.
3. Artificial artifacts: Look for artifacts, such as blurring or pixelation, that suggest the audio or video has been artificially manipulated.
4. Background inconsistencies: Check for inconsistencies in the background of the video, such as objects appearing or disappearing, or changes in lighting that don’t match the audio.
5. Metadata analysis: Analyze the metadata of the audio or video file to determine if it was edited or manipulated.
6. Use of specialized software: There are specialized software programs that can analyze audio and video files to detect deepfakes.

Keep in mind that deepfakes are constantly improving and new techniques are being developed, so it’s important to approach all audio and video content with a healthy dose of skepticism and to be aware of the latest methods for identifying deepfakes.

Preparing for Deepfake Security Threats

To get your network and your employees ready to stand up against the potential risks posed by deepfake videos: 

• Develop and deploy ongoing security training 
• Monitor employee activities on company devices 
• Update your BYOD policy to prevent infected devices from spreading malware to your network 
• Invest in security software with deep learning capabilities to predictively detect malware threats 

Combining employee training with machine learning software minimizes the likelihood of human error and leverages the power of artificial neural networks to protect your company from sophisticated threats and deepfake deceptions. 

The rise of deepfake in a world where fake news is already a concern signals a future in which it could be nearly impossible to trust anything you read, hear or see. Detecting falsehoods requires an updated approach to security, including employing the same technologies used to create deepfakes. The future of security may boil down to beating hackers at their own games, and learning to identify and outsmart threats launched using fake video content could be just the start of a new wave of necessary security upgrades.

This article provides a NIST digital identity summary and update related to NIST special publication 800-63 for digital identity guidelines. The National Institute of Standards and Technology (NIST) digital identity guidelines, known as Special Publication (SP) 800-63, provide recommendations for creating and maintaining secure digital identities. The guidelines are intended to help organizations, government agencies, and other entities establish a secure and trustworthy digital identity ecosystem.

The guidelines offer topics related to digital identity, including:

• Authentication: guidelines for verifying the identity of a user through various methods such as multi-factor authentication, knowledge-based authentication, and biometric authentication.
• Authorization: guidelines for granting access to resources and information based on the user’s verified identity.
• Identity proofing: guidelines for verifying the identity of an individual, including identity proofing remotely and in-person.
• Identity assurance: guidelines for determining the level of trust that can be placed in an individual’s identity claim.
• Risk-based authentication: guidelines for assessing the risk level with a given transaction and adjusting authentication methods accordingly.
• Out-of-band authentication: guidelines for using a separate method to verify an identity.

The NIST digital identity guidelines are voluntary but widely adopted by many companies and governments globally. They are designed to provide a comprehensive and flexible framework for creating and maintaining secure digital identities, with a focus on providing robust remote identity proofing and device-based authentication options, while balancing security and usability.

Purpose of NIST Digital Identity Guidelines

The purpose of NIST digital identity guidelines is to provide a set of best practices for creating and maintaining secure digital identities, to help organizations and government agencies to establish a secure and trustworthy digital identity ecosystem, and to provide a comprehensive and flexible framework for creating and maintaining secure digital identities.

NIST Digital Identity Updates

The National Institute of Standards and Technology (NIST) regularly updates its digital identity guidelines, known as Special Publication (SP) 800-63. These guidelines provide recommendations for creating and maintaining secure digital identities, including guidelines for authentication and authorization. Some of the changes in recent updates include:

• SP 800-63-3 (2017): This update introduced new guidelines for multi-factor authentication and introduced the concept of “verifiers” (organizations or entities that verify identities) and “subscribers” (individuals who are seeking to prove their identity).
• SP 800-63B (2018): This update provided additional guidelines for multi-factor authentication, including guidelines for using knowledge-based authentication (KBA) and risk-based authentication.
• SP 800-63C (2020): This update was a major revision of the previous version, which added new guidelines for remote identity proofing, device-based authentication, and more. The guidelines are focused on the new concept of “identity assurance level (IAL)” and “authentication assurance level (AAL)”

It is important to note that NIST guidelines are voluntary, but are widely adopted by many organizations and government agencies in the United States and around the world.

SP 800-63C Update 2020

SP 800-63C, which was released in 2020, is a major update to the previous version of NIST’s digital identity guidelines. Some of the key updates include:

• Remote Identity Proofing: This update introduces new guidelines for verifying identities remotely, such as through online or video-based methods. This is important in light of the increased use of remote work and online services.
• Device-based Authentication: The update also includes new guidelines for device-based authentication methods, such as using a device’s biometric data or other unique characteristics to authenticate a user.
• Identity Assurance Level (IAL) and Authentication Assurance Level (AAL): In previous versions of the guidelines, NIST recommended different levels of authentication based on the sensitivity of the information being accessed. In this update, NIST introduced the concept of “identity assurance level (IAL)” and “authentication assurance level (AAL)” to provide a more comprehensive framework for assessing the level of assurance required for different types of transactions.
• Biometric Authentication: This update also provides specific guidelines for biometric authentication, which is becoming more widely adopted as a means of verifying identity.
• Risk-based Authentication: The guidelines also introduce the concept of risk-based authentication, which allows organizations to assess the level of risk associated with a given transaction and adjust their authentication methods accordingly.
• Out-of-band Authentication: The guidelines also provide recommendations for out-of-band authentication, which is a method of authentication that uses a separate communication channel (e.g. SMS, phone call) to verify a user’s identity.

Overall, the SP 800-63C update provides a more comprehensive and flexible framework for creating and maintaining secure digital identities, with a focus on providing more robust remote identity proofing and device-based authentication options.

What is Remote Identity Proofing?

Remote identity proofing, also known as remote identity verification, is the process of verifying a person’s identity remotely, typically through an online or video-based process. This can be accomplished through various methods, including:

• Document verification: This involves verifying a person’s identity by comparing information on a government-issued ID (e.g. passport, driver’s license) to information provided by the individual.
• Knowledge-based authentication (KBA): This involves verifying a person’s identity by asking them to answer personal questions, such as their mother’s maiden name or the name of their first pet.
• Biometric verification: This involves using a person’s unique physical or behavioral characteristics (e.g. fingerprints, facial recognition) to verify their identity.
• Video-based verification: This involves using video conferencing technology to conduct a live interview with the individual to verify their identity.

Remote identity proofing is becoming increasingly important as more and more transactions and interactions are conducted online, and in light of the increased use of remote work and online services. The NIST SP 800-63C guidelines provide recommendations for remote identity proofing, including the use of multiple methods to verify identity in order to increase the overall level of assurance.

It’s important to note that remote identity proofing is not a replacement of in-person identity verification, but rather it’s an additional means of identity verification that can be used in certain circumstances where in-person verification is not possible or feasible.

What is Risk-based Authentication?

Risk-based authentication (RBA) is a method of assessing the level of risk associated with a given transaction and adjusting authentication methods accordingly. This approach allows organizations to balance security and usability by only requiring stronger authentication methods when the risk of fraud or unauthorized access is higher.

Risk-based authentication typically involves evaluating a number of different factors to determine the level of risk associated with a given transaction. These factors can include:

• The type of transaction being conducted
• The sensitivity of the information being accessed
• The location of the user
• The device being used
• The behavior of the user (e.g. whether they have a history of suspicious activity)

Based on the level of risk determined, the organization can then choose an appropriate level of authentication to use. For example, if the risk is low, a simple username and password may be sufficient, while a higher risk transaction may require multi-factor authentication (MFA) or other stronger methods.

Risk-based authentication is becoming an increasingly popular approach to identity and access management, as it allows organizations to provide a more seamless user experience while still maintaining a high level of security. The NIST SP 800-63C guidelines provide recommendations for risk-based authentication, including how to evaluate risk and how to implement risk-based authentication in a way that is both effective and secure.

What is Out-of-band Authentication?

Out-of-band authentication (OOB) is a method of authentication that uses a separate communication channel to verify a user’s identity. This separate channel is typically used as a secondary means of authentication, in addition to something the user knows (like a password), something the user has (like a security token), or something the user is (like a biometric).

There are different ways OOB authentication can be implemented, but some common examples include:

• Sending a one-time passcode (OTP) to a user’s mobile phone or email address and asking the user to enter it on the login page
• Making a phone call or sending a text message to a user’s phone number, and asking the user to confirm their identity by responding to the message
• Using an application such as Google Authenticator, that generates a time-based OTP that the user must enter in addition to their password.

The idea behind OOB authentication is that it can be more secure, as it ensures that the person attempting to log in has access to a device or communication channel that is only available to the true user. It can also serve as an additional layer of security in case the primary means of authentication is compromised.

OOB authentication can be used in various scenarios, including high-security environments, such as financial institutions, government agencies, and healthcare organizations, as well as for online transactions that involve sensitive information or large amounts of money. The NIST SP 800-63C guidelines provide recommendations for OOB authentication, including how to implement it in a way that is both effective and secure.

NIST Digital Identity Update Video