Identity Management and UX
When it comes to Identity Management and UX, all businesses interacting with customers, virtually or in person, must balance two key aspects of the interactions – user experience and security. They are often thought of as distinct and mutually exclusive by system and experience designers alike, but this is a mistake. User experience is profoundly impacted by the security choices made by an organization and vice versa.
There are three basic concepts that must be understood when thinking about security. This is true whether we are attempting to secure a web storefront, military installation, museum, shopping mall or any other property. They are: Identification, Validation and Permissions.
A well-designed user experience is built on a clear understanding of the following:
- Who (people and/or entities) will seek access to your property and how will you identify them?
- The type(s) of validation needed to grant access to our property for each of these visitors.
- The level(s) of access within your property that each visitor will be permitted.
Let’s look at each of these and the impact they have on user experience in greater detail.
Understanding Identity
Identity answers one simple question about your visitor – WHO ARE YOU? Once you can answer this question, you can then learn more about the person or entity that you are dealing with. Identity management follows this basic process:
Establish Identity – How we determine who our visitor is, every time they visit. Establishing identity can be done by one or all the following ways.
- Explicitly – Ask the customer to provide information about themselves. For example, create a username or a user profile.
- Systemically – Gather and analyze data from visitor interactions, such as cookies or device identification.
- Externally – Purchase information about visitors from third parties who have compiled information that is useful to you, such as credit bureau reports or social media accounts.
Enrich Identity – How you collect information about the interests, likes, dislikes, affiliations, motivations, and other interesting things about your visitor.
Associate Enriched Data to Identity – How you associate the enriched information compiled about a visitor to their unique identity.
Tailor the Experience – How you modify the user experience to fit the visitor’s profile so that you can deliver better and more meaningful experiences.
Of late, most IAM security tools are catering to the same, not letting stringent security measures and impenetrable firewalls getting in the way of a great user experience. Access management will always be a hassle, there is no way around that. The only thing that can be done, is to make it less of a hassle and intrusive to the workflow. CySec companies have since caught on, and are now making substantial strides in this regard.
Most companies can establish an identity with reasonable levels of competence. However, few companies can enrich an identity effectively. Identity enrichment is essential to tailor user experiences that are meaningful and valuable to a visitor. Otherwise, you’re throwing darts at a target blindfolded and are quite likely to miss. What are some of the pitfalls of identity management? The biggest problem is not designing and managing identity holistically to enable a frictionless user experience. Additionally, technology silos inside your organization will prevent the creation of complete identities. When determining how and when you will establish visitor identity, put yourself in the visitor’s shoes for a moment. Before they provide information about themselves, they need to understand the value of doing so. The modes of identity creation and management will be driven by the following factors.
- Organization Type – A bank or a doctor’s office has different identity requirements than an online store or a news magazine.
- Organization Philosophy – Is the organization customer centric or self-centered? Being self-centered is not always bad. For example, you want your stockbroker to be ‘self-centered’ and jealously guard access to sensitive parts of their site, some of which house your personal account information. Generally, you want to make it as easy as possible for a visitor to discover and engage with you. If you put up roadblocks too early in their journey, they’re likely to give up and leave.
- Customer Choice – Depending on your organization type, it may be appropriate to allow your visitor to choose whether to self-identify, giving them the choice to continue anonymously or to provide information that allows for a more personalized experience.
Use analytics to identify when visitors are abandoning your site can help you shift the timing of your identity activities as needed. Always ask yourself “why do we need this information from my visitor and what do we need it for?”
Understanding Validation
Validation answers the question – ARE YOU TRULY WHO YOU SAY YOU ARE? The process of validating a visitor’s identity is:
Define Validation – How you will determine if a visitor’s identity is correct. This can be a simple username and password combination, two-factor authentication, a visual check of a photo ID, or even a retinal scan.
Create Baseline Validation Mapping – How you will associate a set of validation data with an identity. This baseline will be used to compare future attempts by the visitor to validate their Identity to gain access to your property.
Capture Validation Information – How you will capture the validation information provided by the customer when they access your environment. For example, prompting a user to enter their name and password to access their account, or a guard asking for an ID at the front gate of our facility.
Validate Identity – How you’ll use the information provided by the visitor to verify that it matches their actual identity. For example, checking that the PIN the user enters matches the one sent to the cell phone number you have on file for them.
Understanding Permissions
Permissions answer the question – WHAT ARE YOU PERMITTED TO DO WHEN YOU VISIT MY PROPERTY? Establishing and managing visitor permissions has four basic steps:
Define Permissible Actions – The unique actions that can be performed by a visitor whose identity has been validated in our property. For example, if you have a consumer retail site, you might define actions such as reset password, add new payment method, place an order, cancel an order, and check order status.
Define Roles – A list of the roles that can be associated to a validated visitor which will enable them to perform one or more permissible action on your property. For example, a customer account may have an account owner as well as account members.
Associate Permissible Actions to Roles – Matching the permissible actions to the defined roles. To elaborate on the retail example, an account member can place orders, cancel orders, and check order status, but only an account owner can reset password or add a new payment method to the account.
Associate Roles to Identities – You enable the permissions assigned to roles by linking roles to unique visitor identities. For example, for customer account A39-B, the account owner is James Thurber and the account members are Jane Thurber and Bob Thurber. Now you know, when Jane Thurber logs into our site, exactly what actions she can take.
A well-defined set of permissible actions and roles is a very powerful tool that when used properly can significantly enhance the user experience when they visit your properties. The key to designing roles and permissions is to have a clear understanding of the value delivered to the owner of each role when they visit your property. If there is insufficient value to a role then it is better to either eliminate the role altogether or add value to the role. Associating users to low value roles will result in losing them as visitors.
Impact of Identity Management on UX
User experience is significantly impacted by the identity design choices that you make. You need to understand if, when, and how you will establish and enrich visitor identity. When it is possible to use systemic tools such as cookies or device identification, you should do so to reduce user frustration. If you need to establish or enrich identity explicitly, then you should give considerable thought to the timing of these interactions with the customer, taking into consideration the following:
- Do the content and features behind the firewall have real value to the customer and to you?
- Is the information behind the firewall confidential?
- Is there a legal regulation that requires the creation of explicit identities?
- Are explicit identities required to deliver the functionality to the visitor?
Impact of Validation Management on UX
The first rule of validation is to validate visitors if, and only if, it is essential to do so. Why? First, validation is much more expensive to implement and maintain than identity. Second, it is much more disruptive to user experience than identity. For example, most visitors will remember their username (they probably use the same one for multiple accounts). But they’re highly likely to forget their password, especially for properties they don’t visit every day. When deciding if, when, and how to validate visitors, consider that the level of perceived disruption caused by validation is inversely proportional to the value the information behind the firewall has for the visitor. For example, a visitor is much less likely to feel frustrated entering credentials for their bank account than for accessing the weather report. Additionally, customers will expect a higher level of validation rigor for higher value content. For example, a researcher at a top-secret facility would expect retinal scans to gain entrance and would probably be uncomfortable if the gate guard only glanced at a photo ID instead.
Impact of Permissions Management on UX
Permissions granted through roles are an excellent tool to balance the concerns of user experience and security. When a user perceives that their validated access to your property provides them the tools and information that they need, their satisfaction goes up. Using roles to implement levels of security also protects your or your customer’s assets. For example, anyone showing a photo ID can enter a military installation and use the outdoor running track and picnic area, but to get into the PX or the commissary, one must show a valid military ID, and to access the secure briefing room, one must show proof of security clearance.
In Conclusion
When considering how to incorporate user identity into your user experience design, consider the following design guidelines:
- Identity definition and management should be designed into the solution from the ground up.
- Unique visitor identities should be tied to richer user experiences. Enriching identity with additional visitor context enables customization and, when done well, can significantly enhance the user experience.
- Validate identity as late in the process as possible so as not to frustrate and drive away potential customers.
- Associating visitor identity to roles and permissions is not only an inherent part of security but also reduces user friction and frustration.
- Leverage appropriate technologies to create better visitor experiences.
- Continue to gather visitor data to analyze usage patterns so that you can identify identity management issues and resolve them.
Remember, the key to good identity management and UX is to seek a balance between great user experience and great security. Empathy with your visitor personas will help you walk their path and discover ways to reduce frustration while still accomplishing your goals.
