One year ago, the United States government issued a new mandate. The goal was to transition key government digital infrastructure to “Phishing Resistant MFA” systems by 2024. Phishing is where cyber-criminals use deceptive techniques or even digital spy/surveillance technology to steal the login credentials required to access an account. The traditional password system has always been especially vulnerable to this, as a single password grant total access.

How Passwords Are Stolen

The most common techniques for stealing access are:

Phishing

This usually entails a deceptive email impersonating an individual or organization of authority that requires a credential check-in, usually at a fake website.

Push Bombing

The practice of sending multiple notifications to a person’s device, hoping that fatigue will eventually cause them to erroneously accept a notification and inadvertently grant access to a device.

SS7 Protocol Vulnerabilities

The cellular communication infrastructure has certain vulnerabilities that allow for outside surveillance. More sophisticated cybercriminals can spy on these lines of communication to read messages sent via text/SMS.

SIM Swap

A more specialized form of phishing, this technique impersonates the victim, going to the service provider and deceiving them into surrendering more access to an account to the person posing as the identity that they wish to steal. Here, the victim doesn’t provide access; the victim’s service provider does.

How MFA Helps

Phishing-resistant multifactor authentication, or MFA, throws up barriers that make these established practices nearly impossible to execute. The multifactor nature of this authentication means more than one component is required for verification and access. This means that even if a password is still being used, should it be stolen, other components, such as biometrics, or a physical passkey, prevent the password alone from being enough to grant access.

The Fast Identity Online Association, or FIDO, has worked with the Cybersecurity & Infrastructure Security Agency, or CISA, to create standard phishing-resistant MFA technology that works across different forms of hardware and software. FIDO/WebAuthn authentication and public key infrastructure, like passkeys, mean that even surveillance techniques like SS7 can’t yield complete success for thieves because the required usage of a passkey on a specific device or biometrics, such as a thumbprint, prevents remote access.

This provides government workers the security they need to protect data while still providing the flexibility to securely access that data, onsite or at any location, with their personal devices.

If you’re interested in improving your cybersecurity, you can learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

Government data is some of the most valuable in the United States. Some of it, like data on the citizenry, contains important private information, such as social security numbers, that can be used for identity theft. Other data, such as military or economic information, can be valuable for theft and personal usage or sold to interested parties.

Because of this, government cybersecurity has always been a driving consideration. However, the government doesn’t rely strictly on internal security measures coded by their agencies. Increasingly, the private sector has been providing cybersecurity measures in key areas, with two companies, in particular, making great strides.

A Partnership For Better Cybersecurity

Ping Identity in Colorado and UberEther in Virginia are two prominent American software companies that now work closely with the government on two major fronts; security and identity management. The government had always been interested in improving cybersecurity, particularly identity management, but this need was accelerated two years ago, as the global pandemic began. More and more government workers needed access to their data while working from home. This need for remote access was hampered by legacy security systems that had never intended that kind of access.

Ping Identity and UberEther helped government agencies from municipal, state, and Federal to transition to identity management systems that operated in a hybrid environment. Workers needed flexible systems that allowed them the expected onsite access but also gave them the flexibility to use could-based resources if required.

At the same time, this greater convenience still needed to operate in a “zero trust” environment that assumed all queries were hostile and required multi-factor authentication to verify identities. The days of a single password granting total access wouldn’t work under these more demanding security constraints while providing greater work flexibility.

FIDO Helps

Because of the collaboration between companies like Ping Identity, UberEther, and the Fast Identity Online Association, or FIDO, passwordless multi-factor authentication has become more feasible to implement seamlessly across multiple platforms. Workers are no longer restricted to specific software on specific hardware, allowing people to use more devices in different locations without compromising the sensitive data that must be restricted to only authorized personnel.

Identity management has become increasingly complex as data resides online but must be retrieved from other locations and devices. Passwordless multifactor authentication technology is crucial in providing a way for the government to conveniently access this data while still protecting it.

If you’re interested in improving your cybersecurity, you can learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

Government operates at roughly three levels: municipal, state, and federal. At each level, there is a wealth of valuable information that must remain private either for individual citizens’ protection or national security reasons.

However, when the military’s research wing, Defense Advanced Research Projects Agency, or DARPA, created the “ARPANET,” they laid the cornerstone for the modern Internet that everyone uses today, and everything changed. The ability to send, receive, and access information online made data-based technologies much more efficient but also much more vulnerable. Ever since then, cybersecurity has been a major concern, as it should be.

CISA At Work

In 2018, the government formed a new organization known as the Cybersecurity & Infrastructure Security Agency, or CISA. As the name suggests, this new agency is dedicated to preserving the cybersecurity integrity of government digital infrastructure and other key infrastructure systems that may rely on government systems.

Since its formation, the agency has been evaluating the state of cybersecurity in the United States, and in September of 2022, it presented its strategic plan, which comprises two main spearheads.

Risk Reduction

The first and most important is reducing the vulnerability of various American government digital systems and making them more robust against cyberwarfare, both against private individuals and state-sponsored actors. 2022 has already demonstrated the importance of digital infrastructure as the world witnessed Russian hackers attempt to destabilize Ukrainian infrastructure, such as power generation, during their invasion. Large-scale intrusions have occasionally victimized various corporations and even medical facilities over the years that, compromised the private data of thousands of people. These are all lessons CISA is taking into account for the government’s own cybersecurity.

Resilience

Another key factor is the ability to respond in the event that a system is compromised and a disruption occurs. It’s not enough to create defenses to repel digital incursions; plans must be in place to respond and recover should a compromise occur. Any organization that has no precautions in place for a breach of defense can make a recovery extremely difficult, sometimes even impossible, if there was never a recovery plan in place and the entire system relied on never failing.

To this effect, CISA has worked on recognizing critical infrastructure, looking at the vulnerabilities in place for those systems, and working quarantine and recovery processes to aid in hastening the restoration of critical functions. 

All of these cybersecurity measures encompass newer protocols, such as passwordless authentication systems. If you’re interested, you can learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

Intuit has made a name for itself in financial management by spearheading digital efforts to help accountants and others manage finances digitally, making finances faster, more efficient, and more secure. They are already well known in financial circles for software such as Turbo Tax, Credit Karma, and QuickBooks, which have served individuals and companies alike. Now, according to Yahoo Finance, Intuit has a suite of innovations to make digital financial management even more convenient, all of which point to an increased need for cybersecurity.

Commerce Accounting

A recent survey indicates that a lot of accounting is still carried out through a combination of software and pen-and-paper activities. Commerce Accounting is a new function from Intuit that seamlessly integrates more possible commerce channels into a digital stream to reduce the manual work required.

For example, now sales from retailers such as Amazon, eBay, and Shopify can track and add transactions and other interactions directly into QuickBooks so that users no longer have to enter these transactions into their business financial records manually.

More Cybersecurity Integrations For Mid-Market

Intuit is introducing new features and functionality for mid-market software to help larger companies get more efficient financial accounting and even help to improve sales. QuickBooks, for example, is introducing “Spreadsheet Sync,” which works with industry standards like Microsoft Excel to integrate two-way syncing and help streamline the accounting and reporting of activities.

Other innovations include “Custom Report Builder with Chart View,” which can help to track key performance indicators in sales activity, letting businesses get a more accurate picture of what sales are doing and which factors matter to them.

QuickBooks Online Expansion

QuickBooks itself is increasing its range of services, including software suites for human resource management and centralized online resources for accounting, and even training portals to help businesses and entrepreneurs at different stages of development to incubate important skills and business practices that can be crucial to long-term success.

However, with this emphasis on more convenient online resources, this also means a need for companies to have better cybersecurity. While easy to implement, traditional password systems are increasingly vulnerable to being compromised. Single-factor authentication using a password system introduces a risk of password theft. Many users choose easy-to-guess passwords to make things easier for themselves without realizing this also makes it easy for criminals to guess or “brute force” these passwords. Increased cybersecurity, such as multifactor authentication or passwordless systems like passkeys, can circumvent this.

If you’re interested in passkeys and increased cybersecurity, learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

Traditional passwords, especially those that are only single-factor authentication systems, continue to be one of the weakest ways to secure devices, accounts, and important digital data. It’s one of the reasons why many of the big technology companies such as Google, Microsoft, and even Apple are now embracing passwordless authentication systems that are both more convenient and more secure than the old password system.

Apple, in particular, is now encouraging users to use multifactor, passwordless authentication systems, and many technology outlets, such as Tom’s Hardware, are now showing Apple users how to implement these “passkey systems” on their iPad, iPhone or Mac device.

Encrypted Device-Specific Security

The passkey system adds multiple layers of security to data and devices. It uses two encrypted “keys” that are paired with each other. One is the “public key,” which is encrypted and stored online, while the other, the “private key,” is encrypted and stored only on a specific device, such as an iPad, iPhone, or Mac.

When a user attempts to access an account, device, or data protected by a passkey system, the public key communicates with the private key over encrypted communication channels. When combined with existing biometric measures on Apple devices like TouchID or FaceID, this combination of biometrics and device-specific passkeys mean that stealing access strictly through online means is impossible, while even stealing the device won’t yield access without biometric authentication.

Setting Up Passkeys

Creating a passkey for an Apple device is comparatively simple. The first steps involve:

Going Online

Go into the settings section, select “Password,” then “Password Options,” and toggle on Autofill Passwords. Then tap iCloud Passwords & Keychain.

Enable Passkeys

Click the Apple logo and then go to “System Settings.” Select your name, then “Select iCloud.” Toggle on “Password & Keychain.”

Create Your Key

Your Apple device is now ready to accept a passkey. Use the supporting website or app of your choice, and follow the specific directions for the service you are using.

Changing Security

It’s also possible for accounts with an existing password system to transition to the more secure passkey passwordless authentication system. This varies from service to service, but you can always check by going into the account area of the service or website you use and seeing if a “Set Up Passkey” option is available. If so, tap on that to switch to passwordless authentication on your Apple device.

If you’re interested in passkeys and increased cybersecurity, learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

Multifactor authentication continues to be a new and more secure way for people to access devices, accounts, and data. While the traditional, single-factor authentication password system is fast, cheap, and easy to implement, it is also by far the most vulnerable security system.

As a result of digital security advances, newer and better systems are coming online. According to Gadgets 36-, Google is one of the major players in the technology industry that has decided to help its users enjoy greater security by implementing passkey systems for password-free security.

No More Stolen Passwords

For Chrome users on Android and Mac devices, Google now has a password-free system, known as a “passkey,” that users can use instead of traditional password systems. A single-authentication password system is extremely vulnerable because stealing or guessing the password alone grants total access to a device or account. Moreover, most passwords are considered “weak” because people choose easy-to-guess or remember passwords rather than endure the greater security and inconvenience of the recommended random string of alphanumeric characters that many find too difficult to remember and thus fail to comply with.

Multifactor authentication methods mean more than one form of verification is used. So even if a password is part of that system, stealing the password alone is not enough to grant total access.

How Passkeys Work

Passkey systems operate by pairing together two digital “keys” that must communicate with each other to grant access. A “public key” is first encrypted and stored online. The second, known as a “private key,” is generated for a specific device, such as a phone, tablet, laptop, or desktop computer.

When a user attempts to access an account, data, or device that is passkey protected, the private key in a device must communicate via encrypted channels with the public key. Only after encrypted interaction and confirmation of private and public keys is access granted, but at no point is a passkey required.

Google Spreads The Word

Google is now making it easier for Chrome users to transition from passwords to passkeys. Chrome users who have Android devices can enjoy device-wide usage of passkeys. However, passkeys generated on Chrome for macOS or Windows devices will not have those passkeys shared online, only locally stored on specific devices. However, passkeys are still a stronger form of password-free security, especially when combined with other authentication factors such as biometrics.

If you’re interested in passkeys and increased cybersecurity, learn more here about Nok Nok’s multifactor authentication technology and passwordless security measures.

AP News reports that recent surveys from a digital identity trust company, indicate that 92% of consumers in the USA now believe that cybersecurity threats will outpace current cybersecurity measures. In a study conducted with 2000 Americans and 1000 British, responses indicate that average Americans now believe that the digital environment is inherently risky, with that risk continuing to rise. A surprising 91% of those surveyed showed an interest in taking extra personal digital security precautions, like multifactor authentication, rather than leaving their data entirely up to the protection of external systems.

The Password Is The Culprit

The survey also indicated that 68% of respondents felt that the traditional password security system is the most used yet simultaneously least trusted security measure implemented today. These consumer fears are, unfortunately, well-founded. For several reasons, traditional, single-factor passwords, as a cybersecurity measure, are one of the most vulnerable systems in today’s digital world.

If a password system is single-factor only, that means knowing a password grants total access to whatever is protected behind it. Multi-factor systems at least reinforce security by requiring something more than a password to grant access. However, the biggest issue with passwords is the continued use by many people of “weak passwords.” Most people prefer to use an easy and easy-to-remember password, and it’s not unusual for people to use the same password for multiple accounts.

These two traits combined make many consumers vulnerable. An easy or weak password means it can be easily guessed or even “brute-forced” through a process of elimination. If that password is also used for other accounts, that can potentially mean stealing the password for an online streaming service account can grant access to online shopping accounts, credit cards, and even bank accounts.

Unfortunately, even if a password is “strong” and uses a random string of alphanumeric characters if it is tied to a traditional, single-factor authentication system, it is still vulnerable. The consumer may have strong personal passwords to protect themselves, but they can still be stolen through a security breach, not with them, but with a company with which they hold an account. Businesses such as Yahoo, Sony, Twitter, eBay, LinkedIn, and many others have experienced data breaches where thousands—or even millions—of accounts were compromised and put consumers at risk through no fault of their own. 

Multifactor authentication, however, is making great strides in cybersecurity. If you’d like to give your customers an alternative to passwords and increase your digital security, learn more here about Nok Nok’s next-level multifactor authentication technology and passwordless security measures.