Passwords represent a high security risk for companies. Through password theft, attackers can often penetrate company systems unnoticed and cause a lot of damage.
Passwordless authentication is therefore trending. CyberArk shows what companies should pay attention to during implementation, especially with regard to the IAM solution used. Everyone knows it: Creating a new password is an annoying process because, for example, it has to be at least eight characters long and contain upper and lower case letters, numbers and special characters. But it's a necessary evil because passwords are still one of the most popular targets for attackers. As an alternative to this inconvenient password creation and use, passwordless authentication is currently becoming increasingly important.
Passwordless authentication
Although the concept of passwordless authentication has been around for a long time, it is only recently that this technology has become increasingly actively used. There are various methods - examples include the use of QR codes, SMS messages or USB keys. Passwordless authentication is based on the same principle as digital certificates, which use public and private keys. The benefits of passwordless authentication include improved user convenience and increased security by eliminating password-related risks. The effort for IT is also reduced: passwords that have to be reset are a thing of the past.
But it is also clear that it will hardly be possible to replace all passwords in the foreseeable future. Many legacy systems that are deeply embedded in the IT infrastructure still require passwords. In many areas, however, companies can definitely benefit from the advantages of going passwordless. However, you should keep a few important points in mind. Above all, companies must be aware that the success of a passwordless strategy depends on the selection of authentication factors, which must be tailored to the needs of the company and users. It is essential to implement an adequate IAM solution that should have the following performance characteristics.
- Zero Sign On: The first pillar of a true passwordless solution is a zero sign-on capability that uses strong cryptographic standards such as certificates and associates user identities with additional information such as a fingerprint.
- Integration and support of FIDO2: Almost every provider of identity solutions supports FIDO2 web authentication (WebAuthn), which is an important factor for successfully establishing passwordless processes.
- Secure VPN access for remote and hybrid users: An important security control for authenticating remote and hybrid users is the use of adaptive MFA when they access a corporate network over a VPN.
- Self-service function for exchanging passwordless authenticators: For a true passwordless experience, it is important to implement a solution that gives users the ability to self-register, replace, and delete passwordless authenticators with the appropriate security controls.
“As with any security-related project, detailed strategy and planning as well as partnerships with established providers are essential for companies moving to a passwordless process. Above all, they should have proven know-how in the areas of passwordless authentication and IAM,” explains Michael Kleist, Area Vice President DACH at CyberArk. “However, companies must always remember that passwordless authentication can only be one piece of the security puzzle. Ultimately, only a comprehensive and fully integrated identity security and zero trust strategy guarantees reliable threat protection.”
More at Cyberark.com
About CyberArk CyberArk is the global leader in identity security. With Privileged Access Management as a core component, CyberArk provides comprehensive security for any identity - human or non-human - across business applications, distributed work environments, hybrid cloud workloads and DevOps lifecycles. The world's leading companies rely on CyberArk to secure their most critical data, infrastructure and applications. Around a third of the DAX 30 and 20 of the Euro Stoxx 50 companies use CyberArk's solutions.
Matching articles on the topic