Forget watercooler conspiracies or boardroom battles. There’s a new war in the office. As companies nudge their staff to return to communal workspaces, many workers don’t actually want to – more than 50 percent of employees would rather quit, according to research by EY.
While HR teams worry over the hearts and minds of staff, IT security professionals have a different battle plan to draft – how to make the new normal of the hybrid workplace secure.
The Trade-off Between Usability and Security
A company’s biggest vulnerability continues to be its people. In a hybrid workplace, a Zero Trust strategy means ever-tightening security. The MFA a company chooses affects the difficulty of logging into email, dashboards, workflow tools, client documentation, and so on. Or, conversely, how porous access security is.
Now imagine this scenario. An employee opens a company portal, confirms a prompt on a company app on her phone, and that’s it. She has been authenticated seamlessly by a strong possession factor using her company registered mobile number against the SIM. Nothing to remember, nothing to forget, no tokens, and no codes to type against a countdown.
‘End Points’ Are Human
In order to implement a Zero Trust policy that’s both effective and accessible, it’s time to stop thinking of employees as ‘end points’, and address the human habits in security. For example, a Twitter poll by tru.ID revealed that 40% of people use a ‘mental system’ for passwords.
These mental systems are in a race between complexity and memory. Passwords now need to be long, complicated, and nonsensical – and even those still get breached, thanks to database leaks or phishing scams. This just isn’t sustainable.
Inherence factors such as biometrics still involve friction to set up and use. As we know from the face or fingerprint recognition on our phones, biometrics don’t always work first-time and still require a passcode failover. Plus, not all levels of access require such stringent security.
Possession Factor using Mobile Network Authentication
On the spectrum between passwords and biometrics lies the possession factor – most commonly the mobile phone. That’s how SMS OTP and authenticator apps came about, but these come with fraud risk, usability issues, and are no longer the best solution.
The simpler, stronger solution to verification has been with us all along – using the strong security of the SIM card that is in every mobile phone. Mobile networks authenticate customers all the time to allow calls and data. The SIM card uses advanced cryptographic security, and is an established form of real-time verification …….
Source: https://thehackernews.com/2021/08/new-passwordless-verification-api-uses.html