The Key to Data Security: WebAuthn

What is WebAuthn?

WebAuthn (Web Authentication API) is a global standard specification for secure authentication on the Web, formulated in 2018 by the World Wide Web Consortium (W3C).

This browser-based API allows user authentication on web applications through the creation of strong “credentials” and user-agent-mediated access to authenticators. This could be either in the form of hardware tokens (like U2F security keys) or in-built modules (biometric readers like Google Hello, Apple Touch ID) in the platform. Web Authn has garnered the support of all leading browsers like Chrome, Firefox, and Edge, and is compatible with all leading platforms.

How does WebAuthn Work?

With WebAuthn, a relying party (such as web service) can integrate a strong layer of authentication into applications with a choice of authenticators. It replaces the need for a password with the generation of a private-public key pair (credential) created for a website. While the private key is stored on the user’s device, the public key is generated randomly and shared with the server. The server then uses the public key to confirm the user’s identity.

The following steps are involved in WebAuthn:

  1. The user opens a website using their device
  2. On the request of the web service (replying party) through the Credential Manager API, the browser generates a new credential, specifying the user’s device capabilities.
  3. During the registration process, the user is offered multiple authentication options. This may vary from external authenticators to biometric authenticators like fingerprint analysis or facial recognition.
  4. Choosing any of the authenticators offered, the user completes the registration process.
  5. The authenticator generates a key pair (a public and a private key) – the public key is forwarded to the server, the private key is stored in the user’s device

Why use WebAuthn?

The public key and private key, both need to be used in conjunction. Therefore, by eliminating the need for a “secret” such as a password, WebAuthn drastically improves data security and prevents data breaches. Even if the public key is hacked, it will not function without the private key – which is stored in the user’s device – and becomes useless.

These are some of the scenarios in which WebAuthn can be useful:

  • Setting up two-factor authentication (with or without passwords) that is resistant to friction and phishing
  • Using biometric authorization that eliminates the need for passwords
  • Recovering lost or stolen devices and bootstrapping of new devices 

Find out how you can improve data security and prevent data breaches with Akku. Get in touch with us for a free demo today!

What is Zero Trust Security?

As organizations increasingly place their data and applications across multiple locations on the cloud, zero trust security is rapidly gaining ground as the network security model of choice among enterprises.

Zero Trust Security is a security model in which a user, irrespective of whether he/she is within or outside the network perimeter, requires an additional verification to get access into a network. There is no particular technology or software product associated with this security model. It simply requires an additional security layer to verify users. This could be anything from biometric verification like thumb-print scanning, or a digital signature verification. Of the two, biometric verification is preferable as it can neither be recreated nor hacked.

Traditionally, organizations have been using what is referred to as the castle-and-moat approach to network security. In this model, the network is the ‘castle’ which is protected by security solutions as a ‘moat’. With this approach, part-of-the-network users were blindly trusted and allowed to enter the castle. However, as companies grew, their data and applications grew with them and the need to split them and store them in multiples silos rose. It also became easier for hackers to gain entry into a “protected” network by accessing a single user’s credentials.

Instead of the castle-and-moat model, adopting the zero trust security model and adding an additional layer of security to a network has been shown to prevent instances of data breaches.

Principles behind zero trust security

1. Trust no one: The model assumes that all the users of the network are potential attackers and hence, no users or systems are to be automatically trusted.

2. Least-privilege access: The users are given access based on a need-to-use basis and nothing more. This can eliminate each user’s exposure to vulnerable parts of a network.

3. Microsegmentation: The entire network is split into segments, each with its own authentication process.

4. Multi-factor authentication: Access to the network requires additional evidence that the user is legitimate.

The network of an organization is its gold mine and most organizations are increasing their spend on network security. Implementing a zero trust security model can go a long way in protecting your network from breaches.

Akku from CloudNow is an intelligent security solution which helps you enforce a zero trust security policy. To know more about its features and how it can benefit your organization’s network security, get in touch with us now.

Prevent Cybercrime with the Zero Trust Model of Cybersecurity

Would you trust just anyone to enter your home? Or would you first confirm that you know them and they have the right to be there?

The Zero Trust Model (ZTM) of security follows a similar principle. The ZTM approach is to be aware of anything entering the company, whether from inside or outside the company’s perimeter.

ZTM simply verifies everything that requires access to the system. The approach does not necessarily decree that every request should be denied. Instead, it asks: Why is access needed? How far? How long?

According to Cyber Security Ventures, cybercrime damages will top $6 trillion by 2021. Little surprise that cybercrime is the trending topic today! This may be just a prediction, but an ominous one indeed. It is a great challenge to prevent cybercrime and avoid this predicted damage. However, we can certainly overcome some part of this. We just need to take the right steps to protect ourselves.

The Zero Trust approach depends on different technology and governance processes to achieve their goals. This model mainly focuses on improving the security of the IT environment of enterprises. This approach varies based on who (the User) is accessing what (SaaS or In-house Applications), as well as from where (Location or IP), how long (Time Restriction) and how (granularity) they want to access it.

There are multiple ways an organization can adopt the Zero Trust Model, and one of the best way to do so is to integrate with an IAM. For example, a well-designed application supports IAM integration and provides MFA by default. Today, all applications have begun to adopt the Zero Trust Model at the design level itself.