One year ago, the United States government issued a new mandate. The goal was to transition key government digital infrastructure to “Phishing Resistant MFA” systems by 2024. Phishing is where cyber-criminals use deceptive techniques or even digital spy/surveillance technology to steal the login credentials required to access an account. The traditional password system has always been especially vulnerable to this, as a single password grant total access.

How Passwords Are Stolen

The most common techniques for stealing access are:

Phishing

This usually entails a deceptive email impersonating an individual or organization of authority that requires a credential check-in, usually at a fake website.

Push Bombing

The practice of sending multiple notifications to a person’s device, hoping that fatigue will eventually cause them to erroneously accept a notification and inadvertently grant access to a device.

SS7 Protocol Vulnerabilities

The cellular communication infrastructure has certain vulnerabilities that allow for outside surveillance. More sophisticated cybercriminals can spy on these lines of communication to read messages sent via text/SMS.

SIM Swap

A more specialized form of phishing, this technique impersonates the victim, going to the service provider and deceiving them into surrendering more access to an account to the person posing as the identity that they wish to steal. Here, the victim doesn’t provide access; the victim’s service provider does.

How MFA Helps

Phishing-resistant multifactor authentication, or MFA, throws up barriers that make these established practices nearly impossible to execute. The multifactor nature of this authentication means more than one component is required for verification and access. This means that even if a password is still being used, should it be stolen, other components, such as biometrics, or a physical passkey, prevent the password alone from being enough to grant access.

The Fast Identity Online Association, or FIDO, has worked with the Cybersecurity & Infrastructure Security Agency, or CISA, to create standard phishing-resistant MFA technology that works across different forms of hardware and software. FIDO/WebAuthn authentication and public key infrastructure, like passkeys, mean that even surveillance techniques like SS7 can’t yield complete success for thieves because the required usage of a passkey on a specific device or biometrics, such as a thumbprint, prevents remote access.

This provides government workers the security they need to protect data while still providing the flexibility to securely access that data, onsite or at any location, with their personal devices.

If you’re interested in improving your cybersecurity, you can learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

Government data is some of the most valuable in the United States. Some of it, like data on the citizenry, contains important private information, such as social security numbers, that can be used for identity theft. Other data, such as military or economic information, can be valuable for theft and personal usage or sold to interested parties.

Because of this, government cybersecurity has always been a driving consideration. However, the government doesn’t rely strictly on internal security measures coded by their agencies. Increasingly, the private sector has been providing cybersecurity measures in key areas, with two companies, in particular, making great strides.

A Partnership For Better Cybersecurity

Ping Identity in Colorado and UberEther in Virginia are two prominent American software companies that now work closely with the government on two major fronts; security and identity management. The government had always been interested in improving cybersecurity, particularly identity management, but this need was accelerated two years ago, as the global pandemic began. More and more government workers needed access to their data while working from home. This need for remote access was hampered by legacy security systems that had never intended that kind of access.

Ping Identity and UberEther helped government agencies from municipal, state, and Federal to transition to identity management systems that operated in a hybrid environment. Workers needed flexible systems that allowed them the expected onsite access but also gave them the flexibility to use could-based resources if required.

At the same time, this greater convenience still needed to operate in a “zero trust” environment that assumed all queries were hostile and required multi-factor authentication to verify identities. The days of a single password granting total access wouldn’t work under these more demanding security constraints while providing greater work flexibility.

FIDO Helps

Because of the collaboration between companies like Ping Identity, UberEther, and the Fast Identity Online Association, or FIDO, passwordless multi-factor authentication has become more feasible to implement seamlessly across multiple platforms. Workers are no longer restricted to specific software on specific hardware, allowing people to use more devices in different locations without compromising the sensitive data that must be restricted to only authorized personnel.

Identity management has become increasingly complex as data resides online but must be retrieved from other locations and devices. Passwordless multifactor authentication technology is crucial in providing a way for the government to conveniently access this data while still protecting it.

If you’re interested in improving your cybersecurity, you can learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.