Share on social..
As a strategic IT provider who are experts in cybersecurity measures and risk management, we have recently been banging the drum about how vulnerable using Multi-Factor Authentication (MFA) alone has become.
MFA was created to bolster the security of the original username-password combination after hackers developed technology to crack most passwords.
MFA security measures include SMS/email one-time passcodes, authenticator apps, and biometric technologies like touch ID (fingerprints) and face ID on phones.
MFA security should now be a non-negotiable requirement for businesses (and individuals alike). Today, basic MFA is considered a baseline security measure, and businesses that fail to implement it across all their work applications are left exceptionally vulnerable to cyber threats.
Inevitably, hackers have evolved their methods, and there are now ways for MFA to be breached.
For more detailed information on how MFA can be breached, please see our blog:
The New Reality: Why MFA Alone Won’t Protect Your Business in 2024.
Phishing remains the most lethal hacking method deployed to target individuals – because it’s still proving so successful for them (unfortunately for us).
It was responsible for 84% of cases when a business was breached in the UK last year.[1]
No matter how a hacker gains access to a company’s resources, they will do so through stealing login credentials and by using their own device.
So, what if we can prevent credentials being stolen and block unauthorised devices from accessing company systems?
The great news is that now we can reduce that risk!
At Lumina as part of our PRISM Business packages, we are rolling out several anti-phish security solutions – here is one of them:
There are approximately 30 billion devices in the world today. Your system needs to know that it really is you, or anyone authorised, that is attempting to access company resources.
Passkeys can now help with this.
Passkeys are a new technology that essentially ties a login to a specific device.
They serve as digital credentials that allow access to websites or applications without the need for traditional username-password combinations, and/or MFA.
When a user chooses to set up a passkey for a website/application, two digital ‘keys’ are created. One is private and one is public, and they are then used to authenticate access.
The public key will be stored on the website/apps site, and the private key is stored on the user’s own device that was used to set the passkey up. The public key contains no sensitive data and is effectively useless without the private key.
When using a passkey to sign in to a website/app, the public key on the site must be matched with the private key on the user’s device. The technology is just checking that the two keys match – no secret authentication information is transmitted during this exchange, so no credentials can be stolen.
When a user logs into a website or an application via a username-password combination, they are comparing their password to the copy stored by the site/app. The password that is stored by the site/app can easily be stolen.
This makes passkeys more secure than username-password combination.
Essentially, passkeys cannot be stolen via phishing.
While passkeys offer much higher levels of phishing resistance because they are tied to specific devices, there are some vulnerabilities because no security measure is 100% hack-proof.
Google have now rolled out the use of passkeys for their Advanced Protection Programme (APP), which means it’s more accessible to all of their two-billion customers.
Previously, the APP required users to use a physical security key as an additional layer of security.
The APP uses passkeys as an all-in-one login method without the need for separate MFA credentials.
The APP is the strongest level of Google Account protection, bringing extra safeguards against the most common of attacks that are often launched against high-risk Gmail users: phishing and malware.
Lumina staff members have already taken advantage of this new security update and enrolled in the programme and have set up passkey authentication on their personal Google accounts (we do not use Gmail for work purposes).
It’s very easy to set up – just go to your Google account and set up a passkey option.
Passkeys are the new up and coming technology and they continue to be rolled out as a more effective security measure for both business and individual accounts across the web.
Soon they will become the new normal, just as MFA became widely adopted.
But passkeys are just the start.
There are additional security measures that we are rolling out as part of our PRISM Business packages, to be used in conjunction with passkeys as part of a multi-layered security approach.
Check out our white paper to discover what they are.