A Threat-Informed Framework for Secure Customer Identity (CIAM) Migration in Financial Services: Applying STRIDE, PASTA and Attack Trees to Legacy-to-Passwordless Transitions
Main Article Content
Abstract
Financial institutions are replacing legacy customer authentication (passwords, one-time passcodes and hardware tokens) with phishing-resistant, passwordless Customer Identity and Access Management (CIAM) built on FIDO2 passkeys, OpenID Connect and sender-constrained OAuth 2.0 tokens. Research and standards describe the security of the target state well, but say little about the migration itself. During migration, legacy and modern identity stacks run side by side, customers hold mixed authenticators, and recovery, enrollment and federation paths multiply. This paper argues that the coexistence period is a distinct threat surface and that no single threat-modeling method covers it adequately.
Using a design-science approach, the paper makes four contributions. First, it derives a catalogue of sixteen migration-specific threats (MT-01 to MT-16), including authenticator downgrade, enrollment hijacking, recovery bypass, issuer mix-up and orphaned legacy endpoints. Second, it proposes the Phased Threat-Informed Migration Framework (PTIMF), which uses PASTA as the governing risk process, STRIDE for element-level analysis of phase-specific data flow diagrams, and attack trees for multi-step account-takeover goals. Third, it maps each threat to controls drawn from NIST SP 800-63-4, NIST SP 800-207 and the IETF OAuth security standards (PKCE, DPoP and RFC 9700). Fourth, an analytic coverage evaluation and an illustrative composite banking scenario show that the three methods are complementary: STRIDE surfaces most technical element threats, while process threats such as recovery abuse, policy drift and migration-themed phishing emerge mainly through PASTA and attack-tree analysis. The paper closes with phase-gate criteria for practitioners and a research agenda for empirical validation.
Article Details
Section
How to Cite
References
Akeju, B., Edivri, J., Ogbole, J. I., Okoruwa, P. O., Fadayomi, O., & Abolaji, T. O. (2018). Conceptual model for insider threat classification and risk modeling in complex digital systems. Iconic Research and Engineering Journals, 1(9), 476–492. https://doi.org/10.64388/IREV1I9-1713778
Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. (2012). The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. In 2012 IEEE Symposium on Security and Privacy (pp. 553–567). IEEE. https://doi.org/10.1109/SP.2012.44
Campbell, B., Bradley, J., Sakimura, N., & Lodderstedt, T. (2020). OAuth 2.0 mutual-TLS client authentication and certificate-bound access tokens (RFC 8705). Internet Engineering Task Force. https://doi.org/10.17487/RFC8705
Daraojimba, R. E., Fadero, S., Oyesiji, S. O., & Okoli, I. E. (2025). Quality assurance for secure digital banking and electronic tax filing platforms. Indian Journal of Environment & Development, 16(1), 159–187.
Elebe, O., Anunagba, C. O., Oyesiji, S. O., Ngonadi, U., & Fadero, S. (2025). An analytics-driven framework for continuous IT control monitoring and risk-based audit modernization in US organizations. International Journal of Science, Technology & Society, 9(3), 139–176.
Fadayomi, O., Abolaji, T. O., Edivri, J., Ogbole, J. I., Okoruwa, P. O., & Akeju, B. (2019). Risk-based cybersecurity assurance and data availability: Limitations, advances and future research opportunities. Iconic Research and Engineering Journals, 2(12), 602–617. https://doi.org/10.64388/IREV2I12-1713779
Fadero, S., Abdulwahab, A. I., Minoungou, T. F. T., Anene, U., & Kumuyi, O. (2024). Risk based testing in complex enterprise systems. International Journal of Humanities and Information Technology, 6(4), 275–311.
Federal Financial Institutions Examination Council. (2021). Authentication and access to financial institution services and systems. FFIEC.
Fett, D., Campbell, B., Bradley, J., Lodderstedt, T., Jones, M., & Waite, D. (2023). OAuth 2.0 Demonstrating Proof of Possession (DPoP) (RFC 9449). Internet Engineering Task Force. https://doi.org/10.17487/RFC9449
Fett, D., Küsters, R., & Schmitz, G. (2016). A comprehensive formal security analysis of OAuth 2.0. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (pp. 1204–1215). ACM. https://doi.org/10.1145/2976749.2978385
Ghasemisharif, M., Ramesh, A., Checkoway, S., Kanich, C., & Polakis, J. (2018). O single sign-off, where art thou? An empirical analysis of single sign-on account hijacking and session management on the web. In Proceedings of the 27th USENIX Security Symposium (pp. 1475–1492). USENIX Association.
Hardt, D. (Ed.). (2012). The OAuth 2.0 authorization framework (RFC 6749). Internet Engineering Task Force. https://doi.org/10.17487/RFC6749
Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design science in information systems research. MIS Quarterly, 28(1), 75–105. https://doi.org/10.2307/25148625
Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST Special Publication 800-53, Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
Jones, M., & Bradley, J. (2022). OpenID Connect back-channel logout 1.0. OpenID Foundation.
Jones, M., Campbell, B., & Mortimore, C. (2015). JSON Web Token (JWT) profile for OAuth 2.0 client authentication and authorization grants (RFC 7523). Internet Engineering Task Force. https://doi.org/10.17487/RFC7523
Kalu, A., Fadero, S., Pedro, O., & Mide-Ibrahim, O. (2023). Enhanced due diligence in prepaid and cross-border payment platforms: A risk-typology framework for cardholder account monitoring. International Journal of Technology, Management and Humanities, 9(4), 408–436.
Kalu, A., Pedro, O., Fadero, S., & Mide-Ibrahim, O. (2024). AI-driven transaction monitoring in fintech environments: Comparative false-positive reduction across rules-based and machine-learning detection models. International Journal of Science, Technology & Society, 8(1), 92–122.
Ladapo, O. O., Dosunmu, A. A., Jooda, D., & Abolaji, T. O. (2018). Lessons learned from offline assessment of security-critical systems: The case of Microsoft Active Directory. Iconic Research and Engineering Journals, 2(6), 277–299. https://doi.org/10.64388/IREV2I6-1717205
Ladapo, O. O., Jooda, D., Dosunmu, A. A., & Abolaji, T. O. (2019). Implementation of Active Directory for efficient management of enterprise networks. Iconic Research and Engineering Journals, 3(4), 608–627. https://doi.org/10.64388/IREV3I4-1717206
Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2025). Best current practice for OAuth 2.0 security (RFC 9700). Internet Engineering Task Force. https://doi.org/10.17487/RFC9700
Lyastani, S. G., Schilling, M., Neumayr, M., Backes, M., & Bugiel, S. (2020). Is FIDO2 the kingslayer of user authentication? A comparative usability study of FIDO2 passwordless authentication. In 2020 IEEE Symposium on Security and Privacy (pp. 268–285). IEEE. https://doi.org/10.1109/SP40000.2020.00047
Meyer zu Selhausen, K., & Fett, D. (2022). OAuth 2.0 authorization server issuer identification (RFC 9207). Internet Engineering Task Force. https://doi.org/10.17487/RFC9207
National Institute of Standards and Technology. (2025a). Digital identity guidelines (NIST Special Publication 800-63-4). https://doi.org/10.6028/NIST.SP.800-63-4
National Institute of Standards and Technology. (2025b). Digital identity guidelines: Authentication and authenticator management (NIST Special Publication 800-63B-4). https://doi.org/10.6028/NIST.SP.800-63B-4
Nlerum, O., Fakinlede, F., & Ibrahim, B. (2026). AI-driven anomaly detection frameworks in critical infrastructure networks for proactive threat mitigation. Journal of Engineering Research and Reports, 28(6), 331–348. https://doi.org/10.9734/jerr/2026/v28i61931
Obuse, E., Akindemowo, A. O., Ajayi, J. O., Erigha, E. D., Adebayo, A., Afuwape, A. A., & Soneye, O. M. (2024). A conceptual framework for CI/CD pipeline security controls in hybrid application deployments. International Journal of Future Engineering Innovations, 1(2), 25–47.
Office of Management and Budget. (2022). Moving the U.S. government toward zero trust cybersecurity principles (Memorandum M-22-09). Executive Office of the President.
Office of the Superintendent of Financial Institutions. (2022). Guideline B-13: Technology and cyber risk management. OSFI.
Ogbole, J. I., Okoruwa, P. O., Fadayomi, O., Abolaji, T. O., Edivri, J., & Akeju, B. (2021). Conceptual model for identity-centric zero trust architecture in enterprise security governance. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 7(5), 393–415. https://doi.org/10.32628/IJSRCSEIT
Okoli, C., & Pawlowski, S. D. (2004). The Delphi method as a research tool: An example, design considerations and applications. Information & Management, 42(1), 15–29. https://doi.org/10.1016/j.im.2003.11.002
Okoruwa, P. O., Fadayomi, O., Akeju, B., Edivri, J., Ogbole, J. I., & Abolaji, T. O. (2020). Conceptual model for privacy-centric security engineering in digital and cloud computing systems. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 6(5), 371–389. https://doi.org/10.32628/IJSRCSEIT
Onche, V. O., & Ogbonna, C. S. (2022). Password practices, authentication behaviour, and data-protection compliance among secretarial professionals in higher education. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 1001–1015. https://doi.org/10.54660/.IJMRGE.2022.3.6.1001-1015
Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A design science research methodology for information systems research. Journal of Management Information Systems, 24(3), 45–77. https://doi.org/10.2753/MIS0742-1222240302
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
Sakimura, N., Bradley, J., & Agarwal, N. (2015). Proof Key for Code Exchange by OAuth public clients (RFC 7636). Internet Engineering Task Force. https://doi.org/10.17487/RFC7636
Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., & Mortimore, C. (2014). OpenID Connect Core 1.0. OpenID Foundation.
Schneier, B. (1999). Attack trees. Dr. Dobb's Journal, 24(12), 21–29.
Shostack, A. (2014). Threat modeling: Designing for security. Wiley.
Soneye, O. M., Tafirenyika, S., Moyo, T. M., Eboseremen, B. O., Akindemowo, A. O., Erigha, E. D., Obuse, E., & Ajayi, J. O. (2024). Conceptual framework for AI-augmented threat detection in institutional networks using layered data aggregation and pattern recognition. World Journal of Innovation and Modern Technology, 8(6), 197–227. https://doi.org/10.56201/wjimt.v8.no6.2024.pg197.227
Tuma, K., Calikli, G., & Scandariato, R. (2018). Threat analysis of software systems: A systematic literature review. Journal of Systems and Software, 144, 275–294. https://doi.org/10.1016/j.jss.2018.06.073
UcedaVélez, T., & Morana, M. M. (2015). Risk centric threat modeling: Process for attack simulation and threat analysis. Wiley.
Venable, J., Pries-Heje, J., & Baskerville, R. (2016). FEDS: A framework for evaluation in design science research. European Journal of Information Systems, 25(1), 77–89. https://doi.org/10.1057/ejis.2014.36
World Wide Web Consortium. (2021). Web Authentication: An API for accessing public key credentials, Level 2 (W3C Recommendation). W3C.
Xiong, W., & Lagerström, R. (2019). Threat modeling – A systematic literature review. Computers & Security, 84, 53–69. https://doi.org/10.1016/j.cose.2019.03.010