Redefining multifactor authentication: Why we want passkeys

Persistent threats equivalent to enterprise electronic mail compromise (BEC) necessitate an evolution of cybersecurity defenses to guard identities. Transitioning away from a reliance on authenticator apps and IP fencing towards a complete zero-trust framework, incorporating FIDO2 security keys or passkeys, provides a path to safer and user-friendly authentication experiences. By embracing these applied sciences, organizations can fortify their defenses towards refined cyber threats, making certain the next stage of security in an more and more digital world.

We’ve all heard that id is the brand new security boundary. This modification grew to become a actuality when software program as a service (SaaS) grew to become mainstream. What does “id is the brand new security boundary” imply? The extra we authenticate to cloud apps, the much less reliant we’re on firewalls to guard our identities.

CSOs appear to nonetheless be catching as much as securing identities on this new trendy SaaS world. On February 12, 2024, Microsoft VP Alex Weinert introduced solely 38% of all authentications to M365 are protected by multifactor authentication (MFA).  

One instance of why MFA is essential: The one most typical security menace is enterprise electronic mail compromise (BEC). Hackers have discovered {that a} phishing electronic mail that results in a wire switch is the bottom effort with the best reward. The US Federal Bureau of Investigation (FBI) has acknowledged that BEC is a significant menace to the worldwide economic system with losses estimated at $50 billion from 2013 to 2022. There have been 80 occasions extra losses as a result of BEC than ransomware in 2022 ($2.7 billion versus $34 million).

Throughout that very same time, MFA adoption has elevated considerably. So why has MFA not slowed down BEC assaults? I’ve helped dozens of BEC victims over time and I’ve discovered a lot of the assaults have been preventable. Right here’s how hackers are bypassing MFA at this time and why the FIDO Alliance’s Passkeys will assist.

The vulnerabilities of authenticator apps

Authenticator apps, designed to offer a second layer of security past conventional passwords, have been lauded for his or her simplicity and added security. Nonetheless, they don’t seem to be with out flaws. One important challenge is MFA fatigue, a phenomenon the place customers, overwhelmed by frequent authentication requests or just following a single password spray assault, inadvertently grant entry to attackers. Moreover, attacker-in-the-middle (AiTM) strategies equivalent to Evilginx2 exploit the communication between the person and the service, bypassing the newer code-matching expertise supplied by trendy authenticator apps. These vulnerabilities spotlight the necessity for a proof of the phrases and a dialogue on why such assaults are difficult to stop.

The inefficacy of IP fencing

On the floor, IP fencing, the apply of limiting entry to companies based mostly on the person’s IP deal with, provides an easy security resolution. But, this technique is more and more impractical and outdated in at this time’s SaaS world and incompatible with the rules of zero belief equivalent to assume breach.

Zero belief is a security technique and strategy for designing and implementing the next set of security rules:

• Confirm explicitly: At all times authenticate and authorize based mostly on all accessible knowledge factors.
• Use least privilege entry: Restrict person entry with just-in-time and just-enough entry (JIT/JEA), risk-based adaptive insurance policies, and knowledge safety.
• Assume breach: Reduce blast radius and phase entry. Confirm end-to-end encryption and use analytics to get visibility, drive menace detection, and enhance defenses.

That is the core of zero belief. As a substitute of believing the whole lot behind the company firewall is protected, the zero-trust mannequin assumes breach and verifies every request as if it originated from an uncontrolled community. No matter the place the request originates or what useful resource it accesses, the zero-trust mannequin teaches us to “by no means belief, at all times confirm.”

So, don’t configure an entry checklist to limit entry to somebody’s residence community, which operates on the belief that the house community is protected. Assume that the person, the system, and the community have all been compromised. Authenticate the person and the system. Apply microsegmentation. Implement host-based firewalls.

IP fencing could have a job in limiting privileged IT accounts as a fourth issue of authentication (after password, authenticator app, and system) for privileged IT accounts, but it surely doesn’t scale to common customers due to the appearance of privateness options in working programs like Apple’s iOS (starting in model 15) make IP fencing unrealistic since all connections are shielded behind Cloudflare. Safety operations middle (SOC) analysts wrestle to determine these connections if the id system is just not designed to authenticate each the person and the system.

Once I see IP fencing deployed, I see gaps in insurance policies to make exceptions for BYOD gadgets. It’s because authenticating a BYOD system is just not simply achievable with out the consent of the worker. Ninety-five p.c of organizations allow their workers to make use of private gadgets. It’s not potential to have an IP fence tied to a person’s id when customers are permitted to make use of their private telephones since most customers push again and don’t allow IT to put in company cell system administration (MDM) apps on their private gadgets. That is the commonest criticism I hear from IT departments at this time.

Attackers can exploit the inevitable hole that will get created when IP fencing is barely utilized to Home windows and macOS and cell gadgets are excluded. The hacker can merely replace their internet browser to emulate a cellphone, and they’re in.

This user-agent spoofing erodes the reliability of IP-based controls, which can’t be reliably utilized to BYOD cell gadgets (with out the person consenting to enrolling their cellphone into MDM, deploying a cert, or putting in a VPN). This highlights the need of evolving past static protection mechanisms and embracing the zero-trust paradigm.

The function of FIDO2 and system compliance

The restrictions of MFA and IP fencing underscore the urgency for adopting a zero-trust security framework. FIDO2, with its hardware-based tokens, provides a big leap in security by offering sturdy phishing resistance. When mixed with system compliance checks via an MDM resolution equivalent to Microsoft Intune or VMware Workspace ONE, organizations can be sure that solely safe, up-to-date gadgets achieve entry to delicate sources. This technique not solely addresses the shortcomings of earlier strategies but additionally aligns with the zero-trust precept that trusts nothing and verifies the whole lot.

Navigating compatibility: The combination of passkeys

Whereas bodily FIDO2 security keys (equivalent to Yubikeys) characterize a big development in passwordless and phishing-resistant authentication, compatibility points, notably on cell gadgets, posed challenges to adoption, particularly in Microsoft Enterprise retailers. It was too technically difficult for non-technical finish customers to combine them with their private telephones. There was no full resolution since authenticator apps will not be but phishing-resistant. Lastly, the reliance on bodily security keys launched logistical hurdles and prices.

The modern idea of passkeys provides a promising resolution. Primarily based on FIDO requirements, passkeys are a alternative for passwords that present sooner, simpler, and safer sign-ins to web sites and apps throughout a person’s gadgets. Not like passwords, passkeys are at all times sturdy, phishing-resistant, and device-bound, eliminating the necessity for added {hardware}. Passkeys simplify the person expertise by eliminating the password. Microsoft’s initiative to combine passkeys into their conditional entry authentication options in Microsoft Entra ID as early as March 2024 marks a pivotal step towards simplifying and strengthening authentication practices and follows via on the joint dedication that Apple, Google, and Microsoft made on Might 5, 2022, to undertake the passkey customary. Apple made good on their dedication with the combination of Passkeys in iOS 16, and Google did so within the fall of 2023.

Some great benefits of passkeys

Passkeys stand out for his or her inherent phishing resistance, as they’re tied to each the system and the precise service, mitigating network-based AiTM proxy assaults equivalent to Evilginx2. This shifts the battle to defending towards main refresh token theft on the Home windows system.

Passkeys not solely improve security but additionally enhance the person expertise by eliminating the necessity to handle bodily tokens. The shift to passkeys represents a cheap technique for organizations, lowering the overhead related to distributing and changing bodily tokens.