Joe Garber |
Cyberattacks, both phishing-related and otherwise, are on the rise as bad actors at home and abroad are bypassing the traditional perimeter and exploiting gaps and inconsistencies in how organisations authenticate their workforce to gain access to critical infrastructure.
Multifactor authentication (MFA) has gained traction as a key tool in the arsenal to prevent cybercriminals from obtaining the keys to the kingdom. Don’t believe me? MFA was mentioned 18 times in a January 2022 memo from the US White House Office of Management and Budget as it outlined critical security measures to dramatically reduce the risk of successful cyberattacks against the federal government. And while this guidance was geared toward the public sector – and organisations that support the same – the foundation of this document was sourced from public and private sector experts and can be applicable to any organisation around the globe.
But how do you modernise your authentication practices and deliver phishing-resistant MFA without penalising users or administrators, particularly if leveraging Azure Active Directory (AD)?
The answer is passwordless authentication, and success focuses on five key criteria:
1. Breadth: Cast a wide net and focus on several key elements at the same time – for example privileged users, mobile devices, and securing the hybrid workforce.
2. Integration: Ensure whatever solution you leverage to supplement what you already have is fully integrated with your Azure AD environment.
3. Automation: Make sure you orchestrate key processes to alleviate work on your administrators and helpdesk.
4. Visibility: Attain a single pane of glass to easily manage various authenticators from one location, all tied to their Azure account.
5. Control: Retain control of credentials and permissions, ideally within a virtual private cloud.
This important strategy delivers several critical benefits. By eliminating passwords, you will better protect your workforce by delivering phishing-resistant authentication. And by focusing on solutions that simplify and reduce friction for users, you will empower your organisation and achieve greater adherence to best practice security policies, while lessening the burden on your administrators and helpdesk.
Passwordless also provides a clear path toward achieving zero-trust security. The zero-trust model is ‘never trust, always verify’. By eliminating passwords, and by requiring users to authenticate using phishing-resistant MFA, companies can help ensure the highest level of security for their devices, users, networks and resources.
Joe Garber is chief marketing officer at Axiad
This article was originally published in the Summer 2022 issue of Technology Record. To get future issues delivered directly to your inbox, sign up for a free subscription.