Adaptive authentication
When implementing authentication, businesses often have to choose between security and user convenience. Either they can implement highly secure, high-friction multi-factor authentication flows or go for a low-friction, low-security login scenario. With adaptive authentication, you no longer have to decide between security and user convenience, as you can dynamically react during login flows, depending on underlying contextual information or business rules. For more details please visit and read our blog post: What Is Adaptive Authentication.
Adaptive authentication effectively balances your security requirements with the optimal user experience. During login, Nevis automatically collects, parses and assesses various signals from the current users' context.
For example:
- Their current location (geo-location).
- Their traveling distance (geo-velocity), if they did sign-in previously from other locations.
- Their device, with advanced fingerprinting.
- Their intended action.
- Their source IP reputation, based on external IP reputation services.
Based on these various inputs for each authentication, Nevis continuously builds a risk profile for the user. Nevis reacts to specific events and risk scenarios, such as sign-in from a new device or an impossible travel (e.g. a sign in within hours from both Berlin and San Francisco) and can decide to notify the user or provide additional means of authentication via multi factor authentication. You can read here for more technical details.
With Nevis you have the freedom and power to fully configure your adaptive risk engine. You can decide which of the contextual signals the risk engine should take into consideration, how these signals should be weighed, what the thresholds should be, and what actions should be triggered if an authentication attempt is flagged as risky.
React with Risk Profiles
With the risk profiles one can have strict or balanced options, with pre-configured medium and high threshold values. These values could be fine-tuned by the user if needed. The profiles have been designed in a way to react as described in the table nested bellow. We can provide further fine-tuning if needed in case of special client circumstances.
Typical use cases and the associated expected behavior
React to Events
Besides the sophisticated and advanced risk profiling of Nevis which can be fine-tuned down to the smallest detail for your specific use cases, we have also developed a simpler to configure, but nonetheless, highly-effective, rule-based risk engine.
Simply choose from pre-defined events and decide on the desired behavior that should be triggered with “if-then” rules and you are good to go.
The project template
The Nevis project template Adaptive Authentication is configured to use the nevisIDM Admin GUI application by default as the protected web service. It supports username / password login infrastructure as first authentication step and further, additional security elements (silent e-mail notification, step-up authentication) according to the risk evaluation results. This is subject to change by the user.
For demonstration purposes, the template also includes a demo application called adaptapp (showcasing the reporting REST API of nevisAdapt) that helps to overview login and session details.
Scenario for testing a successful deployment
- Launch your nevisIDM Administration GUI application at
https://your_domain_goes_here/nevisidm- replace “your_domain_goes_here” with your real domain name! - Login with your default bootstrap credentials (and change your initial password).
- At first login (so called training mode) a second factor authentication is required (email TAN → default, hardcoded/test code is AAAAA). In case of success login is granted → nevisIDM Admin GUI appears
- Logout!
- Perform a second login without changing environment (browser, user, IP, etc) → NO second factor authentication is required since the connection is already a known one, login is granted → nevisIDM Admin GUI appears
- Now it is time to replace the exposed example application by your own service and enjoy the Nevis security experience!