How AI Changes App Authentication and Authorization
AI is everywhere. You can’t go anywhere without running into an app or an enhanced online service. According to IBM, 76% of companies are using or exploring AI in their businesses, and SD Times research commissioned by Okta finds 97% of product engineering teams expect to use AI tools in development by the end of 2024.
AI is bringing productivity gains like we’ve never seen before. However, it also leads to new cyberattacks that damage businesses and people’s data.
As AI becomes more ingrained into our daily lives, I predict the future of AI will be a world in which intelligent agents operate in the digital world on our behalf. They book a hotel or a flight for us, buy tickets for a concert or sell shares in the stock market. As these situations require using personal data and information; people must trust their identities to AI.
Standard identity challenges will now have new dimensions. Developers will need to navigate offering different levels of access and control for a user versus an AI agent operating on their behalf. This added complexity of securing applications will be especially difficult for developers building identity solutions in house.
AI Brings New Threats to Traditional Apps
AI is now empowered to enhance traditional application security threats. For example, chatbots and convincing deepfakes with voice are being used for social engineering attacks; attackers are using AI to detect and exploit vulnerabilities in applications very quickly.
With AI, bad actors can scale their operations more easily, and campaigns like phishing are no longer manual, expensive undertakings. Researchers even found that deep learning language models can help write more effective phishing emails than humans can.
As these identity-based attacks become increasingly dangerous, developers must ensure their application authorization and authentication are secure, and that only legitimate users can successfully access their accounts.
Developers Are the New Bot Battlers
With these evolving application security threats, developers are left to battle bad actors and bots that try to compromise customer identity. With bots making up nearly 50% of all internet traffic, developers need to balance making it harder for malicious actors to abuse sign-up and login while delivering digital experiences that will boost end-user adoption.
Bots have become notoriously effective at solving simple image-based CAPTCHAs — often solving them faster and more accurately than humans. In this case, AI-powered tools can help developers act as effective defense mechanisms, analyzing attack patterns and detecting bot activity with virtually zero customer friction. These tools can analyze various signals related to application access activity and compare them to historical data in search of common patterns. If suspicious activity is detected, an additional authentication factor will be requested to verify the user’s identity.
New Vulnerabilities With AI-Powered Apps
As the new frontier in software development, AI applications face similar security issues as traditional applications, such as unauthorized access to information, but with malicious actors’ use of new techniques.
With AI-powered applications, classic building blocks of app architecture, such as frontend, backend and database, are replaced by new elements such as large language models (LLMs) and vector databases. This adds new challenges to traditional application security — prompt injection, data poisoning and data disclosure, among others.
The Open Worldwide Application Security Project (OWASP) has compiled a list of the top 10 vulnerabilities for LLM-based applications. Many of them are related to identity, such as sensitive information disclosure (when an application reveals sensitive information due to lack of proper authorization or filtering process) and excessive agency (when an AI agent is delegated to perform an operation based on an input prompt or the output of an LLM without proper precautions).
This is a new territory for app development. It’s giving new dimensions to traditional identity challenges, such as ensuring that only authorized users can access specific resources and being able to validate the identity of the AI agent to perform sensitive operations, which requires a careful authorization process.
Helpful Innovations Are Underway
Identity is foundational for any app in the AI era, but developers can easily consume their time building and maintaining it in-house. Fortunately, research towards innovations is underway to help you build secure AI applications. The Auth0Lab team has already begun experimenting with ways to protect AI-based applications through opportunities like AI and fine-grained authentication (FGA) and content authenticity.
At Okta, we’ve expanded our Auth0 free plan and enhanced the paid tiers — offering identity tools like multifactor authentication (MFA) and passwordless for free — as well as introduced Okta AI to make identity easy to implement and extend for any use case.
