Using Passkeys in Corporate Environments

Posted on June 13, 2024 by Brent Huston

In an age where cyber threats morph daily, the corporate world scrambles for more secure authentication methods. Enter passkeys—a term heralding a revolution in digital security. What are these digital keys that promise to fortify the gates of corporate information fortresses?

PassKey Understanding how passkeys function illuminates their potential to become the linchpin of corporate security. With benefits ranging from reducing phishing to simplifying the login process, passkeys present an enticing alternative to traditional passwords. This article offers an insight into the realm of passkeys, their synergy with multi-factor authentication, and the intriguing possibility of facial recognition as a passkey.

From access management to enterprise security, the article navigates through the complexities of implementing passkeys in a corporate environment. It delves into the technical intricacies of key pairs and security keys, while also presenting real-world case studies. Prepare to explore a new frontier in cybersecurity—a journey through the adoption and integration of passkeys in the corporate arena.

Overview of Passkeys

Passkeys represent a paradigm shift in online security, reimagining user authentication to be both more secure and user-friendly. A digital successor to the traditional password, passkeys offer companies a way to prevent phishing attacks, since credentials cannot be reused across services. They are pivotal in simplifying the login process while fortifying security.

What are passkeys?

Passkeys are a type of multi-factor authentication that leverage a cryptographic key pair—a public key that is stored on the server and a private key kept securely on the user’s device—to authenticate access. This method is deemed more secure and convenient compared to passwords, as it reduces vulnerabilities like credential stuffing and phishing. Passkeys remain device-bound, which means the private key never leaves the user’s device, thwarting interception attempts and ensuring that even if the public key is compromised, accounts remain protected.

How do passkeys work?

The operation of passkeys hinges on public key cryptography. When a user attempts to access a service, the server dispatches a challenge to their device. The device responds by using its stored private key to sign the challenge. This signed response is then relayed back to the server, which verifies the signature using the public key. If the signature is correct, access is granted. Throughout this process, passwords are never required, thereby diminishing the chances of user credentials being intercepted or stolen. Biometric features, such as facial recognition or fingerprint scanning, are frequently integrated to confirm the user’s identity before the device signs off.

Benefits of using passkeys in corporate environments

The integration of passkeys into corporate environments poses a myriad of benefits:

Enhanced Productivity: Passkeys eradicate the inconvenience of remembering passwords, which allows employees to focus on core business tasks without interruption for password recovery.
Lower IT Costs: With device syncing and cloud storage, employees can resolve access issues independently, diminishing the number of helpdesk tickets related to password resets.
Augmented Security: Passkeys stored in the cloud offer additional layers of security when compared to local storage, thus shoring up corporate defenses against unauthorized access and data breaches.
User Experience and Accountability: With passkeys, employees enjoy a seamless login experience across various devices and platforms, which also enables precise tracking of actions on individual user accounts.
Resilience to Phishing: The structure of passkeys inherently resists phishing schemes, which substantially reduces the looming threat of such attacks in corporate settings.

In summary, the rollout of passkeys in the corporate sphere is poised to strengthen security protocols while promoting a more efficient and user-friendly authentication landscape. As technology giants like Apple, Google, and Microsoft endorse this innovative method, the adoption of passkeys is slated to become a gold standard for enterprises aiming to fortify their cybersecurity architecture and enhance operational efficiency.

Understanding Multi-Factor Authentication

In today’s increasingly digital corporate landscape, ensuring the security of sensitive information is paramount. One of the pivotal strategies for bolstering identity security in enterprise environments is Multi-Factor Authentication (MFA). MFA isn’t just about adding layers of security; it’s about smartly leveraging various credentials to create a more robust defense against unauthorized access.

What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) is a security mechanism that requires users to verify their identity by presenting multiple credentials before gaining access to a system. Instead of solely relying on passwords, MFA combines at least two of the following authentication factors: something the user knows (like a passcode), something the user has (such as a security key or smartphone), and something the user is (biometric verification, like a fingerprint or facial recognition). By integrating MFA, organizations can dramatically reduce the odds of a security breach, as gaining access requires circumventing several security layers rather than just one.

How can passkeys be used as part of MFA?

Passkeys are a relatively new but powerful player in the MFA arena. Functioning as cryptographic key pairs, they securely encrypt data and guarantee that the user is who they claim to be without the pitfalls of traditional password-based systems. In the context of MFA, passkeys are the possession factor – something the user has. Because the private key is stored on the user’s device and never shared, passkeys significantly mitigate the risk of credential attacks. When used together with a biometric factor or PIN (something the user is or knows), passkeys embody the principles of MFA while offering a consistent and user-friendly authentication experience.

Advantages of using passkeys for MFA in corporate environments

The adoption of passkeys within corporate MFA systems presents a range of advantages that extend beyond traditional security benefits:

Enhanced Security: Passkeys are secure by design, featuring lengthy, unique, and randomly generated strings that are incredibly challenging for bad actors to compromise.
Reduced Risk of Phishing: Due to their cryptographic nature, passkeys are resilient to credential stuffing and phishing attacks, as they cannot be reused or easily intercepted.
Ease of Implementation: The integration of passkeys into MFA systems is supported by major technology providers, simplifying deployment in corporate settings.
Non-repudiation: Passkeys offer an audit trail, linking actions directly to individual users, which helps with compliance and incident analysis.
Streamlined User Experience: Passkeys eliminate the frustration associated with forgotten passwords, thus improving productivity and user satisfaction.

In essence, passkeys as part of MFA in enterprise settings not only amplify security but also promote a more intuitive and frictionless user experience, which is instrumental in nurturing a security-conscious culture without sacrificing efficiency.

Exploring Facial Recognition as a Passkey Option

In corporate settings, the quest for robust security measures that also elevate convenience is relentless. Facial recognition emerges as a shimmering beacon in this realm, offering a way to both solidify security protocols and streamline access processes. By incorporating facial recognition technology, passkeys not only transcend the traditional password paradigm but also reimagine user authentication through a seamless, passwordless experience.

Introduction to facial recognition technology

Facial recognition technology rests on the cutting edge of biometric verification, providing a sophisticated yet user-friendly method for identity confirmation. When paired with passkey technology, it bolsters the security framework, enabling users to gain access to systems, websites, and apps with just a glance. Notably, Microsoft’s Windows Hello presents a shining example of this technology in action, advocating for a phishing-resistant login that employs facial recognition, eliminating the dependency on recollectable passwords. The harmonious marriage between passkeys and facial recognition sets the stage for a future where traditional authentication methods gracefully bow out, making room for a more secure and convenient approach—echoing the industry’s pursuit of advancing user-centric security measures.

Using facial meeting as a passkey in corporate environments

The implementation of facial recognition as a passkey within the corporate landscape brings forth a plethora of benefits. This merger of technology offers a reciprocal reinforcement where the reliability of cryptographic key pairs complements the uniqueness of biometric data, yielding a fortified bulwark against unauthorized entry. Such synergy not only deters phishing attempts and mitigates password breach incidents but also refines the user experience to an impeccable standard. Employees are alleviated from the burdensome task of password memorization and management, thus enabling a swift and uninterrupted transition between tasks. Moreover, by streamlining the authentication process without compromising security, facial recognition passkeys promise a reduction in IT-related expenditures, tipping the scales toward operational efficiency and cost-effectiveness.

Security considerations and challenges with facial recognition as a passkey

While the fusion of passkeys and facial recognition represents a monumental leap in access management, it is imperative to scrutinize any potential security implications and challenges. Passkeys, erected upon the foundation of public and private cryptographic keys, must be vigilantly protected, with the sanctity of the private key being paramount. The utilization of FIDO standards, embedded in strong cryptographic principles, endorses the integrity of passkey systems that integrate facial recognition. However, the accuracy and reliability of such biometric systems, as well as concerns around potential privacy invasions and spoofing, must be cautiously considered and mitigated through ongoing improvement and rigorous standards compliance. Despite these hurdles, Google’s initiative to eschew passwords in favor of biometric authentication heralds a transformative shift, promising a harmonious balance of enhanced security and user-centric convenience, tailor-made for the digital age.

Implementing Access Management with Passkeys

Access management serves as the gatekeeper in corporate settings, dictating the realms of digital resources that employees can traverse. It determines the level at which individuals have the privilege to engage with data across an array of devices, such as any device, strictly managed ones, or ones under heightened supervision. Managing the distribution and syncing of critical components like passkeys is instrumental in safeguarding corporate data. This function is flexible, allowing for configurations that suit the security topology of a company, whether passkeys are accessible on any device, are restricted to managed devices, or are limited to supervised appliances only. The architecture of device management servers is fundamental, as they must endorse the intricacy of access management to ensure that work-related passkeys are synchronized exclusively with company-managed hardware.

Role of Passkeys in Access Management

In the labyrinth of corporate cybersecurity, passkeys signify a transition from broad to surgical access controls. Administrators now have the dexterity to assign specific keys to users or groups, thereby defining access limits to company resources with precision. This is not just a step forward in security—it’s a leap, setting up a fortress resistant to phishing and insensitive to unauthorized data excursions. Passkeys empower workforces by sanctioning synced device usage, boosting productivity, and trimming support costs that typically accompany the drama of password resets. When it comes to safeguarding company secrets, passkeys are akin to personal bodyguards, ensuring that only vetted personnel gain passage. Their authentication process, firmly rooted in biometric or PIN verification that doesn’t leave the secure confines of the user’s device, raises the parapet against attackers hunting for shareable secrets.

Best Practices for Implementing Passkeys in Access Management in Corporate Environments

To tether passkeys to productivity is to embrace a form of digital liberation. By allowing employees access from a spectrum of devices, they become unbound from the chains of singular workstations, surfing the waves of flexibility while buoyed by cloud-stored security. The transformation of authentication within the corporate sphere is evident as passkeys promise stronger protection and traceable user activity, critical in swiftly navigating through the aftermath of security events or policy infractions. Moreover, remote work dynamics, which have become part of the modern corporate narrative, are buoyed by passkeys guarding the entrance to corporate networks like sentinels, preventing the seepage of sensitive information.

The adoption of passkeys mandates a calculated strategy, considering the mosaic of organizational controls. Embrace the vetting of third-party security, dive deep into the security and auditability of cloud offerings, and address possible weaknesses head-on to bolster phishing defenses. Here is a checklist for organizations ready to embark on the passkeys quest:

Assess and accept third-party security controls.
Evaluate the security and accessibility of cloud services involved in storing and managing passkeys.
Formulate robust organizational policies for authentication management.
Continuously monitor and mitigate vulnerabilities to enhance phishing resistance.

By adhering to these guidelines, enterprises can navigate the passkey landscape with confidence, journeying toward enhanced security and operational fluidity.

Enhancing Security with Passkeys in Enterprise Environments

In the digital realm of enterprise environments, security is paramount. The advent of passkeys marks a new chapter in the narrative of cybersecurity, providing a strong, user-friendly method of authentication. Backed by FIDO Authentication, passkeys function as advanced digital credentials, enabling employees to gain system access seamlessly, devoid of the need for conventional passwords. The cryptographic signatures inherent to passkeys are unique to each user and tethered to their specific devices, fortifying security measures and streamlining the login process.

Leveraging passkeys elevates enterprise security by thwarting common threats that plague password-reliant systems. These threats manifest in the forms of phishing, credential stuffing, and the ever-present danger of weak and reused passwords. As a vanguard technology, passkeys endeavor to transcend these limitations, providing a fortified barrier that cyber culprits find nearly insurmountable. Furthermore, the shift towards passkeys in corporate landscapes seems inevitable as more enterprises recognize the drawbacks of password-dependent systems and embrace the gold standard of security that passkeys represent.

Unique security challenges in enterprise environments

The pivot to passkeys in corporate settings must confront an array of unique security conundrums. Predominantly, the present lack of support for Strong Customer Authentication (SCA) by passkeys poses compliance challenges within heavily regulated industries. Enterprises must juggle the implementation of passkeys with meeting the stringent stipulations of regulatory frameworks such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA).

Traditional password-based authentication is a breeding ground for vulnerabilities and unauthorized access, a significant pain point for enterprises. The human contingent often emerges as the weakest security link, with users historically defaulting to easily decipherable passwords that are frequently recycled across platforms. This human tendency increases the susceptibility to cyber-attacks manifold, thereby amplifying the urgency for more robust authentication technologies. Security teams, alongside Chief Information Security Officers (CISOs), are tasked with meticulously vetting authentication methods and ensuring they align neatly with organizational controls.

How passkeys can address these security challenges

Passkeys provide a secure, systematic solution to the intricate challenges of enterprise authentication. Reducing the reliance on passwords eliminates a significant vector for data breaches and unauthorized ventures into corporate data. Passkeys’ resistance to phishing attacks lies in a simple yet profound principle—they do not revolve around shareable secrets. Consequently, the risk of crucial information being intercepted or duped is significantly lowered.

Accountability is heightened in a passkey-centered authentication framework. Each action can be precisely mapped back to its performer, aiding in the rapid unraveling of security incidents or violations of policies. Moreover, the rise of remote and hybrid work models magnifies the value of passkeys. These keys act as gatekeepers, ensuring that remote access to critical networks is an exclusive privilege for authorized personnel. Complementing passkeys with additional security measures like multi-factor authentication (MFA) and single sign-on (SSO) further propels identity security, paving the way for secure and efficient access across an expanse of applications and devices.

Case studies of passkey implementation in enterprise environments

An examination of real-world applications reveals the tangible benefits of integrating passkeys into enterprise settings. Organizations that have woven passkeys into their cybersecurity fabric have observed a marked enhancement in user accountability, with each transaction or action being attributable to a specific user. This attribution is not only beneficial for routine audit trails but also proves invaluable when a swift response is critical—during a data breach, for instance.

Remote work, a fixture of contemporary corporate culture, gains a fortified layer of security through implemented passkeys. The assurance that sensitive systems remain impenetrable to all but explicitly permitted personnel is a testament to the efficacy of passkeys in modern environments. Comprehensive policies and practices encompassing password management, access delineation, MFA, SSO, and adoption of password managers are pillars of effective passkey implementation.

As cybersecurity strategies evolve, the synergy between passkeys and SSO-enabled applications becomes noteworthy. Companies have been adopting passkey-supported password managers to streamline access management, concurrently enhancing identity security and user experience. This alliance illustrates the potential of passkeys to redefine authentication, carving a path toward a user-friendly and secure enterprise landscape that transcends traditional password dependencies.

Key Pair and Security Key: Strengthening Passkey Authentication

Passkeys are revolutionizing enterprise security by leveraging key pairs—a public and a private key, which work in tandem to fortify authentication processes. When a user registers with a service, they generate a key pair and the public key is sent to the service to be stored on its server. The private key, which is never shared or transmitted, is securely stored on the user’s device. This mechanism improves security by replacing vulnerable passwords with cryptographic credentials that are unguessable and unique to every interaction, thereby setting a new precedent in secure access management in the corporate domain.

What are key pairs and security keys?

Key pairs are at the heart of passkey technology. A public key encrypts information, which can only be decrypted by the corresponding private key. This customization of keys means that even if a public key is intercepted, unauthorized entities cannot decrypt the information without the private counterpart. Passkeys elevate security by binding these cryptographic keys to a user’s device—typically a smartphone or hardware token—using protocols underpinned by FIDO Authentication standards. This secure storage ensures that only authorized personnel can gain access to enterprise systems, and the decryption capabilities are safeguarded from potential cyber threats.

How do key pairs and security keys enhance passkey authentication?

Key pairs and security keys heighten passkey authentication by creating a system that is inherently resilient to phishing, pretexting, and other social engineering attacks. Since the private key is device-bound and not stored on any server, hackers are left with no actionable data, even in the unfortunate event of a server breach. Passkeys are service-specific, removing the vulnerability of reused credentials across multiple sites—a common pitfall that often leads to cascading security breaches. By effectively eliminating complex passwords, key pairs streamline the user experience, while simultaneously bolstering security, illustrating a win-win scenario for businesses and users alike.

Examples of key pair and security key implementation in corporate environments

In the corporate sphere, the implementation of passkeys with key pairs results in a multifaceted enhancement of security protocols. Biometric checks such as fingerprints or retina scans serve as a validation method without exposing biometric data—it stays within the user’s device, with only a signal of successful verification reaching the server. With the future direction towards passkey and password manager collaboration, passkeys will likely be stored in secure vaults provided by password management solutions, further solidifying corporate data protection.

Companies can supplement current password policies by implementing passkey-enabled systems that encompass:

Biometric authentication for swift and secure access
Robust password manager applications to support the transition and maintain rigorous admin controls
Continual compliance with evolving industry standards ensuring a resilient defense against unauthorized access

In summary, the synergy between key pairs and security keys within passkey frameworks presents an innovative leap in the realm of cybersecurity. As organizations embrace this advance, they lay the groundwork for a more secure, password-free future that promises not only improved protection but also a more streamlined authentication experience for users.

Summary

In today’s dynamic enterprise environments, passkeys are emerging as a robust solution to traditional authentication challenges. They mark a significant shift from passwords by enabling passwordless sign-ins, making use of convenient and secure methods such as Touch ID or Face ID. Passkeys are unique for each app or website, greatly enhancing security and offering a consistent user experience. With the capability to be stored on smartphones, users benefit from the flexibility of either having their passkeys synchronized across platforms via the cloud or tied to individual devices.

These cryptographic keys are designed to be phishing-resistant, mitigating common security issues like credential stuffing. They can be stored either on a user’s mobile device or a dedicated physical security key, providing a seamless authentication process. By leveraging cryptographic key pairs compatible with FIDO devices, passkeys not only bolster security but also streamline the user interface.

The adaptation of passkeys in corporate environments promises to reduce the frequency of password resets, thwart unauthorized access, and counteract credential attacks more effectively than traditional two-factor or multi-factor authentication methods. Passkeys are primed to become the industry standard, delivering additional security without compromising on user experience.

* AI tools were used as a research assistant for this content.

Third-Party Authentication Inventory Worksheet

Posted on May 31, 2024 by Brent Huston

We often get asked for worksheet questionnaires to help organizations inventory their third-party applications and the underlying authentication mechanisms.

As such, we have developed a template for our clients and others to use for this purpose.

You can easily distribute this worksheet to each part of the business or group, empowering them to complete it for each of their third-party applications.

Once they return the data, you can extract it into any aggregation tool or vendor monitoring system you use. If you don’t have those tools available, you can process and monitor them manually using this easy spreadsheet for each line of business.

You can get the template spreadsheet here.

As always, we hope these tools are helpful. Let us know if you have any questions or feedback.

How To Implement a Basic ZTNA Architecture

Posted on May 14, 2024 by Brent Huston

Implementing a Basic Zero Trust Network Access Architecture

Implementing a Zero Trust Network Access (ZTNA) architecture is increasingly essential for organizations aiming to secure their networks against evolving cyber threats. Zero Trust is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify everything trying to connect to its systems before granting access.

1. Define the Protect Surface

Identify the critical data, applications, assets, and services (DAAS) that need protection. This step is crucial as it allows you to focus your resources and security measures on the most valuable and vulnerable parts of your network.

2. Map the Transaction Flows

Understand how traffic moves across your network. Mapping the traffic will help you identify legitimate access patterns and needs, which is essential for setting up appropriate security policies.

3. Architect a Zero Trust Network

Create a micro-segmented network architecture. Micro-segmentation involves dividing the network into small zones to maintain separate access for different parts of the network. Each segment or zone should have its own security settings, and access should be restricted based on the principle of least privilege.

4. Create a Zero Trust Policy

Develop a policy that specifies how resources in the network are accessed, who can access these resources, and under what conditions. This policy should enforce that only authenticated and authorized users and devices are allowed access to the specified network segments and resources.

5. Monitor and Maintain Network Security

Implement security monitoring tools to inspect and log network traffic constantly. This can help detect and respond to threats in real-time. Regular audits and updates of the zero trust policies and architecture should be performed to adapt to new threats and changes in the organization.

6. Leverage Multi-factor Authentication (MFA)

Enforce MFA to ensure that the chance of unauthorized access is minimized. MFA requires users to provide two or more verification factors to gain access to a resource, adding an extra layer of security.

7. Implement Least Privilege Access

Ensure that users only have access to the resources that they need to perform their job functions. This should be strictly enforced through rigorous access controls and ongoing management of user permissions.

8. Utilize Endpoint Security Solutions

Secure all endpoints that access the network by ensuring they meet the security standards before they are allowed to connect. This often includes anti-malware and anti-virus software, and endpoint detection and response (EDR) solutions.

9. Educate and Train Employees

Provide regular training to all employees about the cybersecurity policies, the importance of security in the workplace, and best practices for maintaining security hygiene. A well-informed workforce can be your first line of defense against cyber threats.

10. Engage Expert Assistance

For organizations looking to develop or enhance their Zero Trust architectures, it is often beneficial to engage with cybersecurity experts who can provide tailored advice and solutions. MicroSolved, Inc. (MSI) has been at the forefront of information security, risk management, and compliance solutions since 1992. MSI offers expert guidance in strategic planning, configuration, policy development, and procedure optimization to ensure your Zero Trust implementation is robust, effective, and tailored to your specific organizational needs. Contact MSI to see how we can help your security team succeed in today’s threat landscape.

* AI tools were used as a research assistant for this content.

FAQ for Enterprise Authentication Inventory

Posted on February 10, 2023 by Brent Huston

Q: What is authentication inventory?

A: Authentication inventory is the process of identifying and documenting all of the systems and applications that require remote access within an organization, as well as the types of authentication used for each system and any additional security measures or policies related to remote access.

Q: Why is authentication inventory important?

A: Authentication inventory is important because it helps organizations protect themselves from credential stuffing and phishing attacks. By having a complete and accurate inventory of all points of authentication, organizations can ensure that the right security protocols are in place and that any suspicious activity related to authentication can be quickly identified and addressed.

Q: What steps should I take to properly inventory and secure my authentication points?

A: To properly inventory and secure your authentication points, you should: 1) Identify the different types of authentication used by the organization for remote access; 2) List all of the systems and applications that require remote access; 3) Document the type of authentication used for each system/application and any additional security measures or policies related to remote access; 4) Check with user groups to ensure that they use secure authentication methods and follow security policies when accessing systems/applications remotely; 5) Monitor access logs for signs of unauthorized access attempts or suspicious activity related to remote access authentication; 6) Regularly review and update existing remote access authentication processes as necessary to ensure accurate data.

Video: Auditing Authentication Mechanisms

Posted on February 1, 2023 by Brent Huston

Here’s a quick video walkthrough of the presentation around auditing authentication mechanisms.

We are getting some great feedback on this one, and people are rising to the challenge of doing audits for their organizations. Many folks are finding some quite unexpected results!

Let me know on Twitter (@lbhuston) what you discover!

As always, thanks for reading and watching!

Challenges Auditing Authentication Mechanisms in Organizations

Posted on January 10, 2023 by Brent Huston

Authentication mechanisms are essential for organizations to protect their data and systems from unauthorized access. However, auditing these authentication mechanisms can be a challenge due to the complexity of the systems and the ever-evolving nature of cyber threats. This blog post will explore some of the challenges associated with auditing authentication mechanisms in organizations.

Challenges

1. Disparate Authentication Practices – As an auditor, you’re likely to come across a variety of authentication practices that can be difficult to manage. From different passwords to separate systems, disparate authentication requirements can be a major roadblock when auditing authentication mechanisms. To help reduce this challenge, organizations should establish strong identity and access management policies and ensure compliance with relevant regulations.

2. Staffing and Evidence Collection – The challenge of finding and retaining qualified staff who are knowledgeable and experienced in auditing authentication mechanisms is a common issue. Additionally, effective evidence collection is essential to successful audits, yet ensuring that meaningful data is gathered efficiently can be difficult.

3. Internal Controls – Auditors must ensure that the controls in place are sufficient to reduce risks associated with authentication processes. Weak access controls can lead to costly mistakes, potentially risking the organization’s data. Auditors should take the time to develop a detailed understanding of the organization’s internal controls and audit them on a regular basis against up-to-date and relevant threat models.

TLDR

This article discusses the challenges associated with auditing authentication mechanisms in organizations. It highlights three main issues: disparate authentication practices, staffing and evidence collection, and internal controls. Organizations should establish strong identity and access management policies to reduce the challenge of disparate authentication practices. Additionally, finding qualified staff and collecting meaningful evidence can be difficult tasks for auditors. Lastly, auditors must ensure that internal controls are sufficient to reduce risks associated with authentication processes.

PS – Make sure if you are performing such an audit that, you are checking your current practices against international standards, regulatory requirements, privacy rules, and best practice audit controls. Ensure that you are taking the essential steps to protect digital identity, providing strong access control policies and user controls. Reviewing the logging, and event detection capabilities and ensuring that both unauthorized access and successful authentications are being properly monitored in the event that forensic analysis is needed to respond to a security breach or other incident.

PSS – If you need a process for auditing your authentication points, you can find that here.

FAQ for the End of SMS Authentication

Posted on January 4, 2023 by Brent Huston

Q: What is the end of SMS authentication?

A: SMS authentication verifies user identity by sending a one-time code via text message to a user’s mobile phone number. With the rise of potential security risks, many financial websites, applications, and phone apps are phasing out SMS-based authentication and transitioning to authenticator apps that reside on user devices and smartphones.

Q: What are some of the potential security risks associated with SMS authentication?

A: Attackers have a variety of means of intercepting SMS text messages, thus defeating this type of authentication. This increases the risk of interception and misuse of the codes in question and decreases the security of the user’s account with the financial institution.

Q: What is an authenticator app?

A: An authenticator app is an application that resides in encrypted storage on the user’s device and, when prompted, provides a one-time password (“OTP”) just like the code sent in the text message. The difference is, through a variety of cryptographic techniques, once the application is set up and the settings configured, it doesn’t need to communicate with the financial platform and thus is significantly more difficult for attackers to compromise.

Q: What are the steps for organizations to switch from SMS authentication to authenticator apps?

A: Here is a quick overview of what is needed:

1. Research and decide on an authenticator app that meets your organization’s needs. Most of the time, users can select their own apps, and the firm selects the libraries needed to support them. Open source and commercial solutions abound in this space now.

2. Update user accounts in each application and authentication point with the new authentication protocol and provide instructions for downloading and setting up the authenticator app.

3. Educate users on using the authenticator app, including generating one-time passwords (OTPs), scanning QR codes, etc.

4. Monitor user feedback and usage data over time to ensure a successful switch from SMS authentication to an authenticator app.

PS – Need a process for cataloging all of your authentication points? Here you go.

3 Common Challenges Implementing Multi-Factor Authentication

Posted on January 26, 2022 by Brent Huston

Multi-factor authentication is becoming increasingly popular among businesses and consumers alike.

However, many organizations struggle to implement the technology successfully.

Here are three challenges organizations face when implementing multi-factor authentication.

1. Lack of Awareness

Many organizations don’t understand what multi-factor authentication is or why they should use it.

They think it’s too complicated, expensive, or unnecessary.

This misconception leads to a lack of awareness about the security risks posed by weak passwords and phishing attacks.

2. Security Concerns

Some organizations believe that multi-factor authentication adds complexity and cost to their IT infrastructure.

But, in reality, multi-factor authentication doesn’t add much overhead.

Instead, it provides additional layers of protection against cyberattacks.

3. Complexity

Organizations sometimes find it difficult to integrate multi-factor authentication into their existing systems.

For example, they might have to replace old software or change user interfaces.

Some Potential Solution Ideas

If you’re struggling to implement multi-factor authentication, here are some tips to help you overcome these challenges.

1. Educate Employees About Multi-Factor Authentication

Educating employees about multi-factor authentication helps them understand its importance.

Make sure employees know that using multi-factor authentication reduces the likelihood of fraud and improves overall security.

2. Use Technology That Works For You

Multi-factor authentication tools are becoming more popular by the day. Many low-cost, or even free, solutions exist from vendors like Microsoft, DUOand others.

Look for solutions that have easy integration with your existing business infrastructure and systems.

3. Work With A Partner

A partner who has experience implementing multi-factor authentication can be helpful.

An experienced partner can provide guidance and support throughout the implementation process.

4. Make Sure The Solution Is Right For You

Before choosing a solution, make sure it meets your organization’s needs.

As always, if we can be of assistance, drop us a line to info@microsolved.com. We’d be happy to help!

Preparing for the End of SMS Authentication

Posted on November 16, 2020 by Brent Huston

Over the last several years, wealth management/asset management firms have been integrating their systems with banking, trading and other financial platforms. One of the largest challenges wealth management firms face, from a technology standpoint, is managing multi-factor authentication when connecting to the accounts of their clients. In the coming year to eighteen months, this is likely to get even more challenging as SMS-based authentication is phased out.

Today, many financial web sites, applications and phone apps require the use of SMS one-time security verification codes to be sent via text to the user. This usually happens once the user has entered their login and password to the system, after which it triggers the credential to be sent to their mobile phone number on record. The user then inputs this code into a form on the system and it is verified, and if correct, allows the user to proceed to access the application. This is called two factor authentication/multi-factor authentication (“MFA”) and is one of the most common mechanisms for performing this type of user authorization.

The problem with this mechanism for regulating sign ins to applications is that the method of sending the code is insecure. Attackers have a variety of means of intercepting SMS text messages and thus defeating this type of authentication. Just do some quick Google searches and you’ll find plenty of examples of this attack being successful. You’ll also find regulatory guidance about ending SMS authentication from a variety of sources like NIST and various financial regulators around the world.

The likely successor to SMS text message authentication is the authenticator app on user mobile devices and smartphones. These authenticator apps reside in encrypted storage on the user’s phone and when prompted, provide a one-time password (“OTP”) just like the code sent in the text message. The difference is, through a variety of cryptographic techniques, once the application is setup and the settings configured, it doesn’t need to communicate with the financial platform, and thus is significantly more difficult for attackers to compromise. Indeed, they must actually have the user’s device, or at the very least, access to the data that resides on it. This greatly reduces the risk of interception and mis-use of the codes in question, and increases the security of the user’s account with the financial institution.

This presents a significant problem, and opportunity, for wealth management firms. Transitioning their business processes from integrating with SMS-based authentication to authenticator apps can be a challenge on the technical level. Updates to the user interaction processes, for those firms that handle it manually, usually by calling the user and asking for the code, are also going to be needed. It is especially important, for these manual interactions, that some passphrase or the like is used, as banks, trading platforms and other financial institutions will be training their users to NEVER provide an authenticator app secret to anyone over the phone. Attackers leveraging social engineering are going to be the most prevalent form of danger to this authentication model, so wealth management firms must create controls to help assure their clients that they are who they say they are and train them to resist attackers pretending to be the wealth management firm.

Technical and manual implementations of this form of authentication will prove to be an ongoing challenge for wealth management firms. We are already working with a variety of our clients, helping them update their processes, policies and controls for these changes. If your organization has been traditionally using SMS message authentication with your own clients, there is even more impetus to get moving on changes to your own processes.

Let us know if we can be of service. You can reach out and have a no stress, no hassle discussion with our team by completing this web form. You can also give us a call anytime at 614-351-1237. We’d love to help!

All About Credit Union Credential Stuffing Attacks

Posted on October 5, 2020 by Brent Huston

Credential stuffing attacks continue to be a grave concern for all organizations worldwide. However, for many Credit Unions and other financial institutions, they represent one of the most significant threats. They are a common cause of data breaches and are involved in some 76% of all security incidents. On average, our honey nets pretending to be Credit Union and other financial services experience targeted credential stuffing attacks several times per week.

What Is Credential Stuffing?

“Credential stuffing occurs when hackers use stolen information, such as usernames and passwords from database breaches or phishing software from one account, and attempt to gain access to another. The hackers prey on people’s habit of using the same usernames and passwords for multiple sites. Using automated tools, they run large amounts of stolen information across multiple sites looking to find the same usernames and passwords being used elsewhere. Once they find a match, they can monetize the personal and financial information they gather.” (ardentcu.org)

How Common is Credential Stuffing?

Beyond our honey nets, which are completely fake environments used to study attackers, credential stuffing and the damage it causes is quite starteling. Here are some quick facts:

It is estimated that automated credential-stuffing attempts makes up 90% of enterprise login traffic in the US. (securityboulevard.com)
It’s estimated that credential stuffing costs companies more than $5 billion a year and creates havoc with consumers. (ardentcu.org)
According to Akamai’s latest State of the Internet report on credential stuffing, its customers alone were deluged by 30 billion malicious login attempts between November 2017 and June this year, an average of 3.75 billion per month. (theregister.com)
Significant credential stuffing attacks are a favorite of professional hacking groups from Russia, India, Asia and Africa. They often gather extensive lists of stolen and leaked credentials through advanced Google hacking techniques, by combing social media for password dumps (so called “credential spills”) and by purchasing lists of exposed credentials from other criminals on the dark web. Lists of member information from compromised online banking, online retailers and business association sites are common. This information often includes names, addresses, bank account numbers/credit card numbers, social security numbers, phone numbers and other sensitive data – enabling credential stuffing and social engineering attacks against victims around the world.

What Can Credit Unions Do About Credential Stuffing?

The key to handling this threat is to be able to prevent, or at the very least, identify illicit login attempts and automate actions in response to failed logins. Cybercriminals use a variety of tools, rented botnets (including specifically built credential stuffing bots) and brute force attacks to pick off less than strong passwords all around the Internet. Then, as we discussed above, they use that stolen information to probe your credit union for the same login credentials.

The first, and easiest step, in reducing these cybercriminals’ success rate is to teach all of your legitimate users not to use the same password across multiple systems, and NEVER use passwords from public sites like Facebook, LinkedIn, Instagram, Pinterest or Twitter for example, as account credentials at work or on other important sites. Instead, suggest that they use a password manager application to make it simple to have different passwords for every site. Not only does this help make their passwords stronger, but it can even reduce support costs by reducing password reset requests. Ongoing security awareness is the key to helping them understand this issue and the significance their password choices have on the security of their own personal information and that of the company.

Next, the Credit Union should have a complete inventory of every remote login service, across their Internet presence. Every web application, email service, VPN or remote access portal and every single place that a cybercriminal could try or use their stolen credentials to gain an account takeover. Once, the Credit Union knows where login credentials can be used, they should go about preventing abuse and cyberattacks against those attack surfaces.

The key to prevention should start with eliminating any Internet login capability that is not required. It should then progress to reducing the scope of each login surface by restricting the source IP addresses that can access that service, if possible. Often Credit Unions are able to restrict this access down to specific countries or geographic areas. While this is not an absolute defense, it does help to reduce the impacts of brute force attacks and botnet scans on the login surfaces.

The single best control for any authentication mechanism, however, is multi factor authentication (MFA) (basically a form of secure access code provided to the user). Wheverever possible, this control should be used. While multi factor authentication can be difficult to implement on some services, it is widely available and a variety of products exist to support nearly every application and platform. Financial services should already be aware of MFA, since it has been widely regulated by FFIEC, NCUA and FDIC guidance for some time.

More and more, however, credential stuffing is being used against web mail, Office 365 and other email systems. This has become so common, that a subset of data breaches called Business Email Compromise now exists and is tracked separately by law enforcement. This form of unauthorized access has been wildly popular across the world and especially against the financial services of the United States. Compromised email addresses and the resulting wire transfer fraud and ACH fraud that stems from this form of credential theft/identity theft are among some of the highest financial impacts today. Additionally, they commonly lead to malware spread and ransomware infections, if the attacker can’t find a way to steal money or has already managed to do so.

No matter what login mechanism is being abused, even when MFA is in place, logging of both legitimate access and unauthorized access attempts is needed. In the event that a security breach does occur, this data is nearly invaluable to the forensics and investigation processes. Do keep in mind, that many default configurations of web services and cloud-based environments (like Office 365) have much of this logging disabled by default.

While Credit Unions remain prime targets, having good prevention and detection are a key part of strong risk management against credential stuffing. Practicing incident response skills and business recovery via tabletop exercises and the like also go a long way to stengthening your security team’s capabilities.

How Can MicroSolved Help?

Our team (the oldest security firm in the midwest) has extensive experience with a variety of risk management and security controls, including helping Credit Unions inventory their attack surfaces, identify the best multi factor authentication system for their environment, create policies and processes for ensuring safe operations and performing assessments, configuration audits of devices/applications/cloud environments.

We also scope and run custom tabletop exercises and help Credit Unions build better information security programs. Our team has extensive experience with business email compromise, wire/ACH/credit card fraud prevention, cybercriminal tactics and incident response, in the event that you discover that credential theft has occurred.

Lastly, our ClawBack data leak detection platform, can help you watch for leaked credentials, find source code and scripts that might contain reuseable account credentials and even hunt down device configurations that can expose the entire network to easy compromise.

You can learn more about all of our services, and our 28 years of information security thought leadership here.

Lastly, just reach out to us and get in touch here. We’d love to talk with your Credit Union and help you with any and all of these controls for protecting against credential stuffing attacks or any other cybersecurity issue.