Industry Transition To Going Passwordless Used To Strengthen Security & Reduce Costs
Passwordless? Is that even possible?
YES!
In fact, passwordless accesses allow users and companies to:
- Sign into applications and services faster
- Get a higher level of security
- Reduce support costs and increase productivity
We all know the problems with passwords, just insecure by nature, way too hard to remember. Heck, we can’t even all agree on a universal schema, meaning now you have to remember multiple long strings of characters! This has been the main way we’ve authenticated since the 1960s!
Phishing, Word Lists, Brute Force Attacks… the days of passwords are at an end.
Smartphones equipped with biometric sensors brought these passwordless ideas into the open and there’s no looking back.
There has been a lot of progress in passwordless development. This includes the Microsoft Authenticator app (among others), Fast Identity Online (FIDO2) security key strategies, Web Authentication APIs (WebAuthN) and Windows Hello are all making some early waves, but all come with different strategies.
So how do we know which one is best? How do we choose?
It’s not a decision to be rushed for sure. But with access to enough information and proper research, you can pick which is best for your own needs and accessibility compliance.
To get started, here’s some industry facts.
Biometrics makes a lot of sense. Unique to every human are your eyes, fingerprints and facial recognition aspects that are all much better for authentication. That’s where Microsoft Hello draws its line in the sand, with biometrics.
But biometrics alone raise new concerns about privacy, theft and even piracy. In response to this, the FIDO2 standard alleviates a lot of biometric concerns and was designed to never keep, store, copy, share or publish these “biometric images.”
That’s a HUGE step in the right direction.
But why is all this necessary?
The answers might surprise you.
Cost is a big factor with password use, believe it or not.
What?
Well, think of all the lost work time, support calls and help desk hold time just to reset and troubleshoot passwords! What a huge loss in productivity. So much so that Microsoft estimated their yearly cost of password support to be around $9 million!
But now, by using new passwordless technologies, these costs have been lowered by 87%!
According to Microsoft, there is a common four step process to developing a company-wide, passwordless strategy.
First, refine the criteria of your strategy. There’s a lot of options out there, so research which work best for you and will also accomplish accessibility compliance.
Second, take it to the Cloud! At the Cloud, users get both behavior analytics and security intelligence to help secure identities and uncover breach patterns.
Third, enable Multi-Factor Authentication (MFA). MFA is very effective through its use of multiple methods. Microsoft Security Research stated that MFA cuts down account compromises by 99.9%!
Fourth, initiate a pilot test. Start with your riskiest users or groups of users. See how it goes, see what you learn. Try multiple methods on multiple groups. This will typically result in a clear winner for your needs.
As mentioned above, cost is one main factor pushing passwordless technology development, because it results in increased worker productivity and hassle free authentication. It provides immediate, much higher security by eliminating social engineering attacks like phishing and the use of stolen credentials.
User demand is also pushing acceptance and development as users want easy, fast and seamless authentication. Implementing passwordless techniques gives buyers the authentication they want and they are willing to pay for it.
Microsoft estimates that employee access and company policies will be passwordless within six years, while Gartner has stated that by 2022, 60% of large and global enterprises and 90 percent of midsize enterprises will implement some form of these methods in more than half of all use cases. This is up from 5% in 2018.
It’s clear that passwordless authentication is not a fad and it’s not going away.
In fact these new technologies are on track to be the primary way people authenticate in just a few years time. Those that go passwordless benefit from better security, lower operational costs, increased productivity and a much better user experience.
