Multifactor authentication, whether in the form of a PIN, fingerprint or facial recognition, is vital to ensuring authorized users are the only ones accessing company data and applications. Sounds like something every organization should incorporate to solidify its security posture.
The reality is that MFA has not reached an end-to-end universality required to completely seal off the surface area of attack. In fact, according to Secret Double Octopus’ 2022 State of Workforce Strong Authentication report, only 16 percent of organizations use MFA across all password logins. That said, two-thirds of organizations do have two or more MFA solutions. It’s just a matter of them utilizing MFA universally and it begs the question, if they are using it with some applications, why not all?
The numbers seem low considering the security benefits of MFA. But, businesses feel MFA isn’t the end-all of security and that the next-generation of cyber security investment will lead to passwordless authentication across all use cases. In fact, 87 percent see the transition happening within the next five years.
The survey defined next-generation passwordless as FIDO2 security keys and FIDO2-compliant software solutions that leverage decentralized smartphone vaults and biometrics. FIDO2 security keys will replace weak passwords with hardware-based authentication using private/public key cryptography.
After receiving an explanation of what passwordless means, nearly half of IT employees say they adopted a next-gen passwordless solution. The main reasons for passwordless implementation are:
- Improved security,
- Reduced help desk costs,
- Better employee productivity, and
- Engagement and compliance.
Of course, with anything new, there are tribulations that need to be overcome. The lack of expertise in passwordless and the perception that MFA is good enough – or possibly even more secure – are among the top barriers to passwordless adoption.
Despite the misperception toward passwordless authentication solutions, the path seems clear. IT professionals seem to believe that passwordless solutions deliver strong security outcomes and will be the next generation for authentication.
Edited by
Erik Linask
