The IAM Pro’s Guide to Building a Business Case

Legacy authentication solutions were game changers in their time. By enabling employees and partners to gain secure remote access to internal resources, they enhanced productivity and efficiency.

But today, these once effective systems now create pain points and roadblocks. They were designed for a different time to address different problems, leaving them ill-suited to support digital transformation.

As you extend access beyond the firewall to vendors and an increasingly mobile workforce—and, in doing so, face increasing security threats— you know that a username and password just won’t cut it. There are legacy strong authentication options, but they often require expensive hardware tokens, not to mention the associated costs and complexity to administer them.

You need a better authentication solution to secure your digital enterprise.

A modern multi-factor authentication (MFA) solution, centered on identity, can give your users strong authentication to the resources they need—whether on premises, mobile or in the cloud. And it allows them to work the way they want and need to by providing frictionless access from anywhere, at any time and on any device.

As an IAM pro, you know the answer lies in identity. You just need to show others that it does, too.

To build your business case, you must demonstrate how an investment in modern MFA aligns to corporate objectives, enables digital transformation and can propel the business forward. The benefits of cloud-delivered, adaptive multi-factor authentication typically fall into three categories of common business objectives:

• Increased employee and partner productivity
• Reduced risk of breach
• Reduced IT costs and increased predictability of operating expenses

Read on to discover how modern MFA can help you secure your enterprise and contribute to the success of your organization’s top initiatives.

Beyond passwords, two-factor authentication (2FA) is a common form of multi-factor authentication. Requiring two forms of identity that prove something you know, have or are, 2FA assumes that if one authentication mechanism is compromised, the other is unlikely to be.

Legacy 2FA solutions are better than a username and password alone, but they’re far from ideal. Typically requiring clunky hardware tokens and additional passcodes or sign-on steps, they’re costly and complex to deploy, maintain and administer.

Some of the problems they create include:

Costly Hardware and Management Burden

• Ownership costs add up quickly for redundant instances of on-premises servers (as shown in Figure 1) and thousands of hardware tokens.
• Significant labor costs are required to maintain, patch and upgrade business-critical servers, plus ensure end-user device compatibility.

Frustrated Users and Expensive Support

• Forgotten PINs, tokens and passcodes equate to heavy helpdesk burden.
• Lockouts are common when users are allowed only one authentication device.

Imbalance of Security and User Experience

• Poor user experience discourages resource owners from implementing MFA, and complex end-user processes frustrate users and decrease productivity.
• Users are irritated by switching between applications on a desktop or mobile device to enter a one-time passcode.

Restricted Points of Integration

• Authentication methods, like OTPs, hardware and software tokens, limit the use cases where MFA can be applied, impeding digital transformation.
• Lack of available product capabilities and pricing paths for partner and consumer use cases restrict MFA application to employees only.

Limited User and Device Insight

• Security risk increases with the inability to consider the context of the device being used to authenticate.
• Productivity decreases because, in the absence of contextual factors, even users in highly trusted scenarios must authenticate using the most restrictive methods.

Figure 1: Common on-premises legacy multi-factor authentication deployment, with heavy infrastructure and a VPN use case bias. 

A modern, cloud-delivered MFA solution enables users to authenticate to applications using a convenient app on their smartphone. Easy to set up and use, this type of MFA solution gives your users strong authentication for all of the apps they need, no matter where they are.

When governance policies dictate the need for strong authentication, the MFA service sends a notification to the user’s phone. If it’s an iOS or Android device, the Apple or Android notification service sends this notification, eliminating the cost of a voice call or SMS message. Upon receiving the notification, the user swipes his or her device to sign on.

Adaptive authentication allows you to implement a risk-based, step-up authentication process that dynamically assesses the risk associated with the user making the request. The device being used, the network, the location of the user, the resource or application being requested and many other factors can help you establish the associated risk.

Based on this risk, an appropriate request for authentication factors is made, with the goal of making the least impact on the user while still meeting the minimum security threshold.

This type of modern MFA solution provides eight key benefits:

Your business case would be deficient if it didn’t communicate clear benefits to all stakeholders. You can make yours as strong as possible by pointing out the advantages that it will create for those throughout your organization. Here’s who stands to benefit and how when you make the switch to a modern MFA solution.

IT Executives

• Reduced vendor lock and future-proofed solution built on open standards.
• Increased IT capacity with self-service registration and delegated administrative roles.
• Repurposed IT staff for more strategic efforts than maintaining legacy MFA solution.
• More secure partner and consumer experiences facilitated with a full SDK.

IT Security

• Stronger, stepped up authentication for almost any resource, anywhere.
• Heightened security with device insight and MDM integration.
• Reduced friction with resource owners with common UX objections.
• Increased protection in scenarios with known risk (networks, regions, etc.).

IT Budget Owners

• Reduced on-premises hardware requirements.
• Reduced labor costs for hardware and software lifecycle management.
• Reduced user support requirements with intuitive, flexible solution.

End Users

• Intuitive and flexible authentication process.
• Reduced interruptions for authentication only in scenarios IT identifies as a risk.

Application Developers and Resource Owners

• Increased security without compromising user adoption.

To round out your business case, here are the most common cost savings you can expect when you make the move to a modern MFA solution.

Infrastructure Savings

Legacy MFA solutions typically involve servers supporting primary and replica instances. They are used to host authentication processes, user and policy databases, administration and self-service functionality. Additional hardware is also typically required to support geographically dispersed deployments and remote users accessing internal resources. Migrating to a modern, cloud-delivered MFA solution means an absolute reduction in on-premises servers and the associated labor, utilities, maintenance and support involved.

Also of note are the savings realized when hardware tokens are eliminated. For many enterprises, the deployment, management and frequent replacement of often thousands of tokens has long been a costly but necessary measure, and one they’re pretty happy to see disappear.

Licensing and Support Savings

Subscription licensing is often more cost-effective than the perpetual licensing with maintenance and support that legacy solutions require. Subscription-based MFA allows you to scale up or down as needed without locking you into a longterm commitment.

Labor Savings

Labor is the biggest cost savings you’ll realize when migrating to a modern, cloud-delivered MFA solution. Entire teams that once managed an on-premises solution can be refocused on important strategic initiatives. Cloud-delivered MFA removes the need for hardware and software lifecycle management, software distribution, IT-administered client upgrades and configuration. Additionally, it eliminates the significant time spent applying patches and upgrades to agents on network devices and application servers, while ensuring compatibility with all authenticating devices. Finally, an improved user experience often equates to a significant reduction in helpdesk calls, reducing a major category of overall incidents. 

You understand how an investment in cloud-delivered, adaptive multi-factor authentication improves enterprise security, productivity and user experience—all while translating to an across-the-board reduction in costs. Now, you just have to convince others.

When compiling your business case, you can rest assured that recommending a move to modern MFA will deliver widespread advantages that reap benefits across your organization.

Here’s a recap of how cloud-delivered, adaptive authentication addresses both common enterprise concerns and key strategic initiatives:

Increased employee and partner productivity

• Minimized workforce disruption in low-risk user, device and resource contexts.
• Simplified access to applications and resources for remote/mobile workforce.
• Increased ability to enable access to resources in high-risk contexts.
• Improved readiness for emerging authentication technologies and use cases.

Reduced risk of breach

• Enhanced security with contextual data considered during authentication.
• Access to applications and resources restricted to only managed devices.
• Ability to apply step-up authentication to a larger set of use cases.
• Heightened security with device insight for unmanaged devices (BYOD).

Reduced IT costs and increased predictability of operating expenses

• Reduced need for on-premises infrastructure and end-user hardware tokens.
• Eliminated need for associated legacy hardware lifecycle management.
• Decreased labor associated with patch, upgrade, and compatibility assurance.
• Significantly fewer helpdesk resources required.

Ready to build your business case? To learn more about recommending a modern authentication solution for your organization, read the MFA Buyer’s Guide.

And be sure to check out these white papers for information about other popular IAM modernization initiatives:

Part One of Three: Modernizing Legacy Web Access Management (WAM)

Part Three of Three: Consolidating Identities with a Modern Directory Solution

 

#3239 | 05.17 | v001