The amount and sophistication of cybersecurity attacks is increasing. As a result, stricter legislation is accelerated, aiming to protect consumers while governing organizations to prioritize security at the forefront of business decisions.
Passwords are becoming a thing of the past
Passwords have historically been the standard for securing online accounts, however, they are quickly becoming obsolete. They become archaic for two obvious problems. First, without extra layers of security measures, if someone gets your password they can easily access all your personal data, whether through account takeover (ATO) or other digital-identity risks. More than 60% of breaches are a result of compromised passwords. One solution is to use multi-factor authentication which significantly mitigates risks. As people reuse passwords across devices, the risk of password breaches increases. If cybercriminals breach one account, they can use the personal information and password to enter other accounts of the user. Sites such as HaveIBeenPwned have raised awareness of how often the same accounts are exposed over and over again and often with the same passwords, putting the victims at further risk of their other accounts being compromised.
The second problem with passwords is that they still remain a source of friction and frustration for users. Remembering and managing passwords is tedious and disrupts customer experience, often resulting in costs for the organization via helpdesk and support service costs. Where customers become more demanding regarding security and seamless user experience (UX), going passwordless means meeting both of these customer demands. The main achievement of eliminating passwords therefore improves both UX and security.
Current adoption trends for passwordless authentication
Security experts are predicting that passwordless authentication will become the new norm in three to four years. Gartner predicts that by 2025 over 50% of the workforce and more than 20% of customer authentication transactions will become passwordless, which is a 10% increase compared to today.
With the solutions available today, companies can gain a competitive advantage by preparing their systems for passwordless: tending to their customer experience paired with stronger security guarantees. A security research study by 451 Research and Yubico showed almost three quarters of enterprises planning to spend more on multi-factor authentication (MFA) and two-thirds are deploying or currently piloting passwordless authentication. The main reason for this growing recognition of passwordless authentication is driven by enterprises experiencing increased fraud and data breach activities. Similarly, they found that ‘password stealing’ is often the root cause of most security breaches.
At the same time, research done by LastPass identified 92% of businesses believe passwordless authentication is in their organization’s future
FIDO2 for passwordless authentication
One increasingly popular method for passwordless authentication is Fast IDentity Online (FIDO2), which is the new passwordless standard. The authentication token is predicted to see more than 25% of adoption in the next three years, based on Gartner analyst reviews. Although FIDO2 is projected to become a dominant authentication token, it will most likely first spread in workforce use cases, as obstacles are still foreseen for customer use cases. You can read more about FIDO2, what it is, and its potentiality in our post here.
FIDO2 is mostly loved for the security keys solutions that it offers. However, in companies where hardware tokens are not that common, the Phone-as-a-token (Phaat) authentication method carries huge traction in the market, making it a more popular option for FIDO2 in the short-to-mid term. As such, this article will focus on the alternative options for passwordless authentication where companies are unable or cannot wait for mainstream FIDO2 implementation. However, consider FIDO2 options and how it can benefit authentication in your company by reading our second FIDO2 post here.
3 Steps To Implement Passwordless Authentication
Introducing passwordless authentication does not have to be costly or require significant extra effort. In fact, existing net investments can be re-adjusted to encompass passwordless authentication in an efficient way. Below, these first three steps will help you understand where efforts should be focused.
1. Understand your customers, their needs, behaviours, and security risk profiles
The first step is to outline your objectives and identify the drivers - mainly, your users. Do they use laptops, desktop devices, mobile phones, etc.? Depending on your users’ behaviours and needs, they may require different levels of security and user experience.
According to Gartner, security and user experience (UX) are the primary needs of customers for a superior login experience. To address these, consider the following primary goals for strategic authentication implementation and how these resonate with the needs of your customers.
Key Security goals
- Eliminate passwords completely from use and from the infrastructure
- Reduce risks of account takeover (ATO) and digital-identity theft
Key User Experience goals
- Remove passwords from the customer journey
- Avoid additional friction due to forgotten passwords
2. Evaluate your current system and resources
Passwordless authentication does not necessarily mean investing in new technology. Improving or adapting the current authentication methods to not require passwords may suffice to address your customers needs (see figure below). In this example, authentication can be achieved using any combination of signals and credentials without the use of a password. For example, one could implement Biometrics to achieve passwordless authentication.
Another more advanced method for passwordless authentication that enhances frictionless user experience is using recognition and risk signals (see figure below). These are used in conjunction with more traditional MFA solutions. Here the passwordless authentication depends primarily on signals and specific conditions. If these meet certain criteria, then the user can login via ‘zero-factor authentication’ (0FA) or also known as adaptive authentication. If the criteria are not met, then the user is asked to perform a more traditional MFA step to login.
To evaluate your current systems, you may use the following questions to guide you:
Key Questions to evaluate your current security and user experience setup
- Are you already using any type of passwordless methods?
- Are you currently using authentication or Identity Access Management (IAM) solutions?
- Are your current solutions on-premise or in the cloud?
- Can you modify existing customer authentication flows to refrain from using passwords?
- Can already planned investments be used to help migration?
- Are there any urgent needs that demand new net investments?
By answering these questions you can already start to understand what kind of passwordless authentication would be easiest to implement. The best way to address this further is to work directly with your authentication vendor.
3. Minimize time to value
Explore how you can enhance your current systems to go passwordless.
There are two mainstream methods for directly replacing password authentication. The first is to use the phone-as-a-token (phaat) method. Secondly, both single-factor and multi-factor authentication (MFA) can be modelled to authenticate without the use of passwords. For example, using single-factor authentication such as mobile push, one-time password (OTP), or out-of-band (OOB) SMS (although there is increasing criticism for using SMS for authentication). For multi-factor authentication, passwordless methods include using PIN or biometric authentication. A graph below illustrates how these two passwordless methods can be applied.
The first part illustrates implementing phone-as-a-token to a single-factor authentication model. The second part provides an example of phone-as-a-token with multi-factor authentication (MFA). In the MFA example, a password can be replaced simply by adding a PIN or biometric authentication on top of the mobile push or OTP.
In cases where customers do not use mobile phones, OTP hardware tokens are the most common alternative.
Prepare for adoption
Based on Gartner projections, phone-as-a-token authentication is catching significant traction in the market, and will most likely be the most popular form of passwordless authentication in customer use cases. This includes passwordless authentication in the form of mobile MFA, biometric authentication, pattern or picture methods, and adaptive authentication. These solutions are all already available as passwordless MFA authentication by design and are the most easy and straightforward to adopt.
As long as passwords remain in login flows, both organizations and customers will carry the burden of managing passwords, as well as enforcing and complying with effective password policies. Thus the burden of passwords will weigh on both the security and user experience of customers. However, it is evident that organizations across industries are tackling these goals head on. To discover how you can address passwordless authentication for your end-users, you can learn more here.
You can always talk to one of our experts to see how you can improve security and user experience for your users, or read more about potential methods. If you have questions or feedback, please let us know.