Tag Archives: FIDO

Three Approaches to Identity Management

Posted on by

Identity management is the way organizations control access to resources to ensure that the right individuals have access to the right resources at the right time, and it is a key pillar of zero trust architecture. In a zero trust system, a user has to validate and verify their identity continually as they access data and systems. But to function well, this process has to be seamless for the end user. Traditional security measures dependent on passwords cannot scale to meet the needs of zero trust--imagine how time-consuming and frustrating it would be to continually enter a password every time you move to a new application or data set. Fortunately, there are several approaches organizations can use to achieve high levels of both security and useability.

FIDO

Fast identity online (FIDO) is an authentication standard designed to improve security and convenience in identity management by eliminating reliance on traditional passwords. Strong authentication is achieved by using biometrics (such as fingerprints or facial recognition), security keys, or PINs stored on a local device. Continue reading →

The Changing Identity of Identity Management

Posted on by

A key element of the move to zero trust is the use of "strong multi-factor authentication (MFA) throughout their enterprise." While identity management has been indicated by many as the "low hanging fruit" of a zero-trust journey, it is by no means easy. In fact, recent guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) called it "notoriously difficult."

Key challenges to implementing MFA include:

  • Lack of standards - the CISA/NSA guidance pointed to confusion over MFA terminology and vague policy instructions as primary challenges to implementing more secure access. A joint committee of European Union (EU) and U.S. experts addressed this same issue in the Digital Identity Mapping Exercise Report, which aimed to define specific digital identity technical terminology. For example, the group found some definitions, such as "authoritative source" and "authentication factor," are identical between the U.S. and EU, whereas others, like "identity" and "signature," remain only partially matched.
  • Phishing - bad actors do not always hack the system; they hack the process, gaining entry through social-engineering tactics that grow more sophisticated by the day. The CISA/NSA report called on the vendor community to provide MFA services with additional investments and greater defenses against sophisticated attacks.
  • Rise of Generative AI - The Department of Homeland Security (DHS) is working to ensure technologies can determine if a submitted image is legitimate or a hacker's spoof. This "liveness detection" is needed to ensure that a submitted selfie is really a photo of a person, not a mask, photo of a photo, or other technique to try to get past the check.

Continue reading →