Paul Bergman

Rethinking Logins: 5 Points you need to balance

Written by

Paul Bergman

in

,

Managing digital identities can feel like something that only big government agencies or behemoth corporations would bother with—but it’s just as important for small businesses, too. The great news is that you don’t need  to have lots of money or a squad of cybersecurity experts to do it right.

The National Institute of Standards and Technology (NIST) is a great source of guidance on things like this but their documents can be a bit technical. Here is a summary of the NIST Digital Identity Guidelines (SP 800-63-4) with 5 points from the framework to keep in mind.

  1. Risk-Based Approach: Evaluate risks on services being offered and decide on the level of identity assurance needed. For less risky services, minimal verification might suffice, but riskier services will need more secure proofing.
  2. Multi-Factor Authentication (MFA): Use MFA to create security. Simple MFA using simple-to-use authenticator apps or SMS for proof is inexpensive and simple. These are so common now that not using MFA is really questionable.
  3. Federated Identity Solutions: Use existing identity providers (e.g., Google, Microsoft) to authenticate identities, so as to avoid the expense of processing credentials in-house.
  4. Privacy and Usability: Keep identity processes user-privacy-aware and usability-focused. Gather only required information and good data-handling practices communication.
  5. Continued Evaluation: Periodically review and enhance identity management processes to stay up to date with changing threats and new technologies. Seek feedback from users to establish where they can be improved.

Small businesses will be in a position to enhance their electronic identity management processes by embracing the SP 800-63-4 guidelines, achieving a balance between security, convenience, and cost factors.

Paul Bergman
Follow me
Latest posts by Paul Bergman (see all)

More posts