What is risk-based authentication (RBA)? - Definition from WhatIs.com

Definition

risk-based authentication (RBA)

Part of the Authentication glossary:

Risk-based authentication (RBA) is a method of applying varying levels of stringency to authentication processes based on the likelihood that access to a given system could result in its being compromised. As the level of risk increases, the authentication process becomes more comprehensive and restrictive.

You may have experienced risk-based authentication if you've ever accessed your bank account from another country and were asked more than the usual number of security questions. Common criteria for assessing risk includes geographic location, IP address and the status of antivirus software.

When performing a risk assessment for a network or Web site, an administrator should take into account the following factors:

  • The size of the system, in terms of the number of users. As a system grows larger, the chance of a breach increases.
  • The extent to which the system is critical to maintaining the operation of the organization. The most critical systems carry the greatest risk of serious damage in the event of a breach.
  • The ease with which data can be compromised or the system cracked by someone with the means and intent to do so. Ideally, protective measures such as firewalls and antivirus software should be robust and up-to-date, but these measures are not always given top priority when budgets are tight.
  • The relative sensitivity of the data that the system contains. Vital customer information such as names, addresses, and Social Security numbers requires enhanced protection.

Risk-based authentication can be categorized as either user-dependent or transaction-dependent. User-dependent RBA processes employ the same authentication for every session initiated by a given user; the exact credentials that the site demands depend on who the user is. In transaction-dependent RBA processes, different authentication levels may be required of a given user in different situations, based on the sensitivity or risk potential of the transaction. 

This was last updated in December 2014
Contributor(s): Stan Gibilisco
Posted by: Margaret Rouse

Related Terms

Definitions

  • rainbow table

    - A rainbow table is a listing of all possible plaintext permutations of encrypted passwords specific to a given hash algorithm. Rainbow tables are often used by password cracking software for networ... (WhatIs.com)

  • single-factor token

    - A single-factor token is a small hardware device that produces one confirming credential for user authentication; the devices may be used in conjunction with other types of credentials for multifac... (WhatIs.com)

  • multifactor token

    - Multifactor tokens are security tokens that use more than one category of credential to confirm user authentication. The standard categories of authentication credentials are knowledge factors thi... (WhatIs.com)

Glossaries

  • Authentication

    - Terms related to authentication, including security definitions about passwords and words and phrases about proving identity.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question About risk-based authentication (RBA)Powered by ITKnowledgeExchange.com

Get answers from your peers on your most technical challenges

Tech TalkComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.