Authentication Failures Result in the Loss of Customers - New Ponemon Institute Report Finds

A major gap exists between IT and business leaders in understanding and addressing the risks associated with users failing to access services resulting in an adverse effect on digital transformation initiatives.

SAN JOSE, Calif., March 29, 2022 /PRNewswire/ -- A new report conducted by the Ponemon Institute, the preeminent research center dedicated to privacy, data protection, and information security policy, and sponsored by Nok Nok Labs (Nok Nok™), the most scalable platform for modern identity and passwordless customer authentication, highlights the significant costs to businesses that result from authentication failures and weaknesses. Through its own primary research, Nok Nok has been aware that limited business data exists about the state of today's system-level authentication processes and its relation to the business impact of authentication failures. As the first initiative of its kind to address this gap, the Ponemon Institute, working with Nok Nok, launched an industry survey of businesses with current digital transformation projects underway.

A systemic authentication failure occurs when organizations are unable to verify user identity across a user base due to weaknesses in the organization's authentication processes. According to the study, which surveyed 1,007 IT staff, IT security leaders, and line of business leaders (LoBs), the average business losses across all types of authentication weaknesses range from $39 million to $42 million. The study also found that for authentication weaknesses that specifically result in a material business disruption, the average maximum business loss expands the range from $34 million to $40 million. Additionally, the study identified a significant gap that exists between IT security and LoBs in their internal alignment to address system-level authentication failures that prevent access from internal and external users to an organization's goods and services.

Some of the consequences and economic losses created by system-level authentication weaknesses include excessive account recoveries, password resets, and susceptibility to automated attacks such as credential stuffing, where the attacker has a list of valid username and password credentials. Reasons that system-level authentication weakness can be costly include the associated downtime costs incurred to resolve authentication failures across a broad user base, the disruption of business processes, and the negative impact on third-party business relationships. And a key finding from the study is that there is universal agreement among internal stakeholders: when system-level authentications fail, the organization loses customers.

"Although it's not surprising, it is revealing to see how high the cost of a system-level authentication failure can be for an organization," said Larry Ponemon, Chairman and Founder of Ponemon Institute. "Knowing the significant potential cost, the data in this report should enlighten and motivate organizations to re-examine their security processes, access control methods and drive strategic alignment to mitigate system authentication weaknesses and related business risks."

In the use case of employee identity and authentication, the internal gaps and misalignment in understanding system-level authentication can be a barrier to addressing the risks of authentication weaknesses. Some of these gaps highlighted in the survey include:

• The overall control of authentication processes. Only 32% of IT security respondents and 44% of IT security leaders say their organizations have a high level of control over their authentication processes while 67% of LoB respondents are confident in their organizations' controls. There is a 2x disparity in how organizations perceive internal authentication control.
  
  
• Confidence that the risk of authentication failures can be reduced. 66% of LoB respondents say their organizations are very prepared or highly prepared to reduce the risk of authentication failures compared to 40% of IT security staff respondents. The misalignment and 1.6x disparity between internal groups' confidence in addressing these failures foreshadows future systemic problems.
  
  
• Visibility into the increased volume and frequency of authentication failures. 71% of IT security respondents vs. 55% of LoB respondents say authentication failures have significantly increased. A wide disparity exists in how Internal groups assess authentication failures.
  
  
• Recognition of "real" employees, customers, or users from criminal imposters using stolen credentials.  66% of IT security staff respondents said it is very difficult or difficult vs. 48% of LoB respondents to defend against stolen credentials. Both groups agree that it is very hard for organizations to distinguish between credentials of trusted users vs credentials provided by cyber-criminals.

"This data is clearly eye-opening to the sizable risks and costs incurred when organizations do not properly address authentication failures that arise from system-level processes and workflows," said Phil Dunkelberger, CEO of Nok Nok. "The gap that exists between the line of business and IT sides of the organization is alarming. It is clear that internal end-user authentication failures have many risks and incurred costs where the security environment is fairly controlled, meaning where an enterprise controls employee authentication hardware and platforms. Similarly, the same risks and even increased costs must exist where the organization enterprise has little or no control over the devices, platforms or connectivity used by its millions of customers in customer-facing authentication applications."

Mr. Dunkelberger continues with "there needs to be more leadership coming from the top in bringing these two sides together to fix enterprise-wide, system-level authentication failures. Otherwise, the trend will continue and costs will continue to rise. With Nok Nok's current focus on solving customer authentication issues, we have always believed authentication is the front door to customer trust. The results of this survey, as also applied to the consumer authentication use case, implies that system-level authentication weaknesses are going to drive even larger costs to companies, including the loss of their customers. Bottom line, the data related to internal misalignment within an organization shows that companies need to start thinking differently about user identity and authentication. This is one of the reasons why we started Nok Nok: to deliver solutions that provide a holistic approach for an organization's IT and LoB requirements for end-user authentication that accelerate and enable digital transformation".

To download the Ponemon Risks and Cost of Authentication Report, please visit: https://noknok.com/wp-content/uploads/2022/03/Cost-of-Authentication-Failure-Final-1-1.pdf

For more information about Nok Nok's passwordless authentication solutions, please visit: https://noknok.com/solutions/

The Ponemon Institute© is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors, and verifies the privacy and data protection practices of organizations in a variety of industries.

Nok Nok is a pioneer in the FIDO standards and the trusted leader in next-generation identity and passwordless authentication solutions. The Nok Nok™ S3 Suite empowers companies to transform their customer experiences, transactions, business processes, and workflows by leveraging modern identity and passwordless authentication. The Nok Nok™ S3 Suite offers the most scalable and feature-rich passwordless solution that integrates into existing system-level workflows and legacy security infrastructure. Companies that implement the Nok Nok next-gen passwordless platform experience authentication success rates above 99%, onboarding conversion improvements of more than 10%, a 90% reduction in account recovery requests, and significantly reduced OpEx. Headquartered in Silicon Valley, California, the company has delivered unique inventions and innovations that are protected by a robust global patent portfolio. As a founder of the FIDO Alliance and an inventor of FIDO specifications, Nok Nok is the expert in deploying standards-based authentication, and its industry-leading customers and partners include Verizon, T-Mobile, Intuit, Cigna, Softbank, MUFG, NTT Docomo, Fujitsu Limited, Hitachi, Ericsson, MTRIX GmbH, NTT DATA, and OneSpan. For more information, visit www.noknok.com.

SOURCE Nok Nok Labs