Redefining multifactor authentication: Why we need passkeys

Persistent threats comparable to enterprise e mail compromise (BEC) necessitate an evolution of cybersecurity defenses to guard identities. Transitioning away from a reliance on authenticator apps and IP fencing towards a complete zero-trust framework, incorporating FIDO2 safety keys or passkeys, affords a path to safer and user-friendly authentication experiences. By embracing these applied sciences, organizations can fortify their defenses in opposition to refined cyber threats, making certain a better stage of safety in an more and more digital world.

We’ve all heard that identification is the brand new safety boundary. This variation turned a actuality when software program as a service (SaaS) turned mainstream. What does “identification is the brand new safety boundary” imply? The extra we authenticate to cloud apps, the much less reliant we’re on firewalls to guard our identities.

CSOs appear to nonetheless be catching as much as securing identities on this new trendy SaaS world. On February 12, 2024, Microsoft VP Alex Weinert announced solely 38% of all authentications to M365 are protected by multifactor authentication (MFA).  

One instance of why MFA is essential: The only commonest safety risk is enterprise e mail compromise (BEC). Hackers have found out {that a} phishing e mail that results in a wire switch is the bottom effort with the very best reward. The US Federal Bureau of Investigation (FBI) has acknowledged that BEC is a serious risk to the worldwide financial system with losses estimated at $50 billion from 2013 to 2022. There have been 80 instances extra losses because of BEC than ransomware in 2022 ($2.7 billion versus $34 million).

Throughout that very same time, MFA adoption has elevated considerably. So why has MFA not slowed down BEC assaults? I’ve helped dozens of BEC victims over time and I’ve discovered a lot of the assaults have been preventable. Right here’s how hackers are bypassing MFA at the moment and why the FIDO Alliance’s Passkeys will assist.

The vulnerabilities of authenticator apps

Authenticator apps, designed to offer a second layer of safety past conventional passwords, have been lauded for his or her simplicity and added safety. Nevertheless, they aren’t with out flaws. One vital situation is MFA fatigue, a phenomenon the place customers, overwhelmed by frequent authentication requests or just following a single password spray assault, inadvertently grant entry to attackers. Moreover, attacker-in-the-middle (AiTM) strategies comparable to Evilginx2 exploit the communication between the consumer and the service, bypassing the newer code-matching expertise offered by trendy authenticator apps. These vulnerabilities spotlight the necessity for a proof of the phrases and a dialogue on why such assaults are difficult to stop.

The inefficacy of IP fencing

On the floor, IP fencing, the apply of proscribing entry to providers based mostly on the consumer’s IP deal with, affords an easy safety answer. But, this methodology is more and more impractical and outdated in at the moment’s SaaS world and incompatible with the ideas of zero belief comparable to assume breach.

Zero belief is a safety technique and strategy for designing and implementing the next set of safety ideas:

• Confirm explicitly: All the time authenticate and authorize based mostly on all obtainable information factors.
• Use least privilege entry: Restrict consumer entry with just-in-time and just-enough entry (JIT/JEA), risk-based adaptive insurance policies, and information safety.
• Assume breach: Decrease blast radius and section entry. Confirm end-to-end encryption and use analytics to get visibility, drive risk detection, and enhance defenses.

That is the core of zero belief. As an alternative of believing every thing behind the company firewall is secure, the zero-trust mannequin assumes breach and verifies every request as if it originated from an uncontrolled community. No matter the place the request originates or what useful resource it accesses, the zero-trust mannequin teaches us to “by no means belief, all the time confirm.”

So, don’t configure an entry checklist to limit entry to somebody’s house community, which operates on the belief that the house community is secure. Assume that the consumer, the system, and the community have all been compromised. Authenticate the consumer and the system. Follow microsegmentation. Implement host-based firewalls.

IP fencing could have a task in proscribing privileged IT accounts as a fourth issue of authentication (after password, authenticator app, and system) for privileged IT accounts, but it surely doesn’t scale to common customers due to the appearance of privateness options in working methods like Apple’s iOS (starting in model 15) make IP fencing unrealistic since all connections are shielded behind Cloudflare. Safety operations heart (SOC) analysts battle to establish these connections if the identification system will not be designed to authenticate each the consumer and the system.

After I see IP fencing deployed, I see gaps in insurance policies to make exceptions for BYOD gadgets. It is because authenticating a BYOD system will not be simply achievable with out the consent of the worker. Ninety-five p.c of organizations allow their workers to make use of private gadgets. It’s not attainable to have an IP fence tied to a consumer’s identification when customers are permitted to make use of their private telephones since most customers push again and don’t allow IT to put in company cell system administration (MDM) apps on their private gadgets. That is the commonest grievance I hear from IT departments at the moment.

Attackers can exploit the inevitable hole that will get created when IP fencing is simply utilized to Home windows and macOS and cell gadgets are excluded. The hacker can merely replace their net browser to emulate a telephone, and they’re in.

Joe Stocker

This user-agent spoofing erodes the reliability of IP-based controls, which can’t be reliably utilized to BYOD cell gadgets (with out the consumer consenting to enrolling their telephone into MDM, deploying a cert, or putting in a VPN). This highlights the need of evolving past static protection mechanisms and embracing the zero-trust paradigm.

The function of FIDO2 and system compliance

The restrictions of MFA and IP fencing underscore the urgency for adopting a zero-trust safety framework. FIDO2, with its hardware-based tokens, affords a big leap in safety by offering sturdy phishing resistance. When mixed with system compliance checks by an MDM answer comparable to Microsoft Intune or VMware Workspace ONE, organizations can be sure that solely safe, up-to-date gadgets acquire entry to delicate sources. This technique not solely addresses the shortcomings of earlier strategies but in addition aligns with the zero-trust precept that trusts nothing and verifies every thing.

Navigating compatibility: The combination of passkeys

Whereas bodily FIDO2 safety keys (comparable to Yubikeys) characterize a big development in passwordless and phishing-resistant authentication, compatibility points, significantly on cell gadgets, posed challenges to adoption, particularly in Microsoft Enterprise outlets. It was too technically difficult for non-technical finish customers to combine them with their private telephones. There was no full answer since authenticator apps will not be but phishing-resistant. Lastly, the reliance on bodily safety keys launched logistical hurdles and prices.

The progressive idea of passkeys affords a promising answer. Primarily based on FIDO requirements, passkeys are a substitute for passwords that present quicker, simpler, and safer sign-ins to web sites and apps throughout a consumer’s gadgets. Not like passwords, passkeys are all the time robust, phishing-resistant, and device-bound, eliminating the necessity for added {hardware}. Passkeys simplify the consumer expertise by eliminating the password. Microsoft’s initiative to combine passkeys into their conditional entry authentication options in Microsoft Entra ID as early as March 2024 marks a pivotal step towards simplifying and strengthening authentication practices and follows by on the joint dedication that Apple, Google, and Microsoft made on Might 5, 2022, to undertake the passkey normal. Apple made good on their dedication with the combination of Passkeys in iOS 16, and Google did so within the fall of 2023.

Some great benefits of passkeys

Passkeys stand out for his or her inherent phishing resistance, as they’re tied to each the system and the precise service, mitigating network-based AiTM proxy assaults comparable to Evilginx2. This shifts the battle to defending in opposition to major refresh token theft on the Home windows system.

Passkeys not solely improve safety but in addition enhance the consumer expertise by eliminating the necessity to handle bodily tokens. The shift to passkeys represents a cheap technique for organizations, decreasing the overhead related to distributing and changing bodily tokens.