Adaptive authentication can help healthcare fight cybercrime

Just demanding two-factor authentication doesn’t go far enough, expert says.

May 16, 2017 – On the heels of the WannaCry ransomware assault, security experts around the globe are touting their cybersecurity best practices to help healthcare fight off cybercriminals.

Robert Block, senior vice president of identity strategy at cybersecurity firm SecureAuth, said that using an adaptive authentication technique to authenticating users could help not only fight malicious actors but also ease the user experience around security and access.

“We still hear healthcare organizations asking for second-factor authentication; they say we need to put up second-factor in front of all applications containing protected health information,” Block said. “But that might decrease usability. Adaptive authentication can give you layers of security. Adaptive authentication is using a number of variables – unbeknownst to the user, behind the scenes – that allow the policy-making engine, the decision point for authentication, to determine if it will allow a user in, step a user up to second-factor, or deny the user.”

These layers of security occur in milliseconds between a user attempting to log-in to that user being allowed in, given a second-factor or being denied access.

“This type of security adapts the authentication to a risk posture that an organization is willing to accept,” Block said. “If I am coming from a laptop connected to my desk in our healthcare organization network and I am using a known browser I have used before with an installed cookie and I type in my user name and password, the authentication mechanism will determine known network segment, known browser, it feels like this is very low risk to the organization, and it allows me in.”

But if a user is coming from an unknown device and an unknown network, maybe from home, or maybe the user is coming in at an unusual time that is outside his or her normal behavior, or maybe the user is coming in on a mobile device not ported in North America, the adaptive authentication technology can determine a second-factor of security is needed, Block said.

“Perhaps it wants to push a text message to that device for a code as a second-factor,” he said. “It is not saying it does not want you to do your job, it’s just that there are some variables out there it does not understand so it needs to understand if it is really you or not..

While two-factor authentication increases security, adaptive authentication provides these other layers that allow organizations to take an intelligent approach to whether they allow an authentication to occur or not, and to do so in a way that can ease the user experience by not demanding two-factor authentication if a user meets certain criteria, Block added.

Block also said that organizations need to be more of a detective in their authentication processes.

“The authentication process needs to be able to leverage threat intelligence, to be able to understand how to evaluate end-point security, for example, and couple that with the adaptive authentication,” he said. “Using threat intelligence, like-known networks and known actors and known IP addresses and known vulnerabilities to devices, using that in the authentication transaction. The more intelligence you can build into authentication, the more we can stop watching breach report numbers go up year after year.”

Read the entire article at Healthcare IT News here.

Learn how SecureAuth protects healthcare organizations here, or for a demo contact us today.

SecureAuth Identity Platform Adaptative Authentication

Identity and Access Management

Empower your digital initiatives with secure access for everyone and everything connecting to your business

Product Features

Adaptive Authentication

Extend verification of a user identity with contextual risk checks

Multi-Factor Authentication

Leverage a broad portfolio of authentication factors for desktop and mobile

Intelligent Risk Engine

Protect your identities with advanced risk profiling analytics

Single Sign-On

Provide app discovery and one-click login through portal or desktop SSO

User Lifecycle Management

Enable admins with strong CRUD capabilities and users with self-service tools

Secure All Identities


Customer Identities

Deliver a frictionless customer experience safeguarding user data and privacy


Workforce Identities

Govern and control access rights for employees, partners, and contractors

Moving Beyond Passwords

Learn how passwords alone no longer provide the appropriate level of protection, nor confidence, required to secure valuable resources


Passwordless Authentication

Reduce the risk of breaches by eliminating passwords

2FA is Not Enough

Block popular phishing and brute force attacks used by bad actors

Protecting Office 365

Extend adaptive authentication and flexible MFA to all apps including Office 365

Securing Portals and Web Apps

Balance strong security and an exceptional user experience

RSA Migration

Transition to a modern identity and access management solution



Financial Services


Energy and Utilities

Public Sector


White Papers


Recorded Webinars

Analyst Reports

Innovation Labs


Support Portal

Events & Webinars



Calculate Your Savings

Lower support costs by enabling your users the control to reset passwords, account unlocks, device enrollment and update profiles

Meet SecureAuth

About SecureAuth