Category: Single Sign-on

Passwordless Authentication 101: What it is, How you can adopt it, and Why it’s the future

To stick with passwords or to go passwordless is a million-dollar cyber security question. Resetting, remembering, and changing passwords regularly is not only frustrating but puts critical information at risk. But at the same time, have we reached a point where we can realistically remove passwords entirely from our authentication processes?

The drawbacks of passwords

Strong passwords are difficult to remember, and weak passwords are too easy to hack. Additionally, overuse of the same passwords across multiple platforms can result in breaches during credential stuffing attacks.

According to a report from LastPass, weekly time spent managing users’ passwords and login information has increased 25% since 2019. The report also says that 85% of employees agree that their organization should reduce the number of passwords required to be used daily. And according to Verizon data, 81% of data breaches involve weak, default, or stolen passwords.

What is Passwordless Authentication?

Passwordless authentication is user-friendly and secure and brings to the table reduced IT costs by eliminating password-related risks, increased productivity as employees save time remembering or updating passwords, and stronger security. In short, passwordless authentication is both convenient and secure.

Passwordless authentication relies on the same principles as digital certificates, on public and private keys. Think of the public key as the padlock and the private key as the key that unlocks it. With digital certificates, there is only one key for the padlock and only one padlock for the key. For passwordless authentication, a cryptographic key pairs with a private and a public key. A user wishing to create a secure account uses a mobile app to generate a public-private key pair, where the public key is provided to the system, and the private key is accessed from the user’s local device using an authentication factor such as an OTP. 

Here are some ways you can go passwordless

  • Single Sign-on or SSO
    It simplifies managing access and provides employees an easy and secure way to log in. Also, it allows IT to provision or deprovision access as needed. However, while SSO reduces the number of passwords required, it often demands a single password to access all applications. 
  • Biometrics
    Fingerprints, face, iris, voice, and other biometric parameters are used as they are considered more challenging to hack than alphanumeric codes. They are also convenient to use, as they cannot be misplaced, stolen or forgotten. 
  • Hard tokens
    They allow access to software after verification with a physical device. 
  • OTPs
    Users are asked to input the code sent to them via email or SMS. OTPs provide an additional layer to security and are more secure than static passwords. OTPs are often used as a second layer of authentication, but can even replace static passwords. 
  • Private keys
    An alphanumeric string is processed through an algorithm, to encrypt or decrypt data. 
  • Magic Links
    Users enter their email address in a form, and then an email is sent with a login link. 
  • Push Notifications
    Users receive a push notification on their mobile devices through a dedicated authenticator app for identity verification.

Passwordless authentication methods are compatible across most devices and systems. Plus, they’re virtually impervious to phishing and other common cyberattacks.

So, is passwordless authentication the future?

Passwordless methods offer both a more secure and a more convenient way to authenticate users. So the simple answer is, yes, they are the future.

However, considering how ubiquitous passwords are today, they certainly aren’t going to disappear overnight. So until passwordless methods gain in popularity, it’s important to continue to do all you can to ensure strong passwords to secure your applications and data.

Whether you are ready to take the leap to passwordless, or are looking for a way to make your password based authentication more secure, Akku can help you enhance security and productivity across your environment. Talk to us today to see how we can help.

 

A malicious user gaining access to your apps can be catastrophic. Here’s how a secure SSO could help.

In any enterprise, it is a given that employees will come and go, and many will switch roles within the organization as well. At the same time, the same is true for the applications that the company uses – new apps will be deployed, old ones will be retired, and changes are constant.

What this means is a continuous churn – in identity management for users, and service providers, by means of the SaaS applications in use. Ensuring data and app security across the organization depends heavily on ensuring secure communication between your identity provider and service providers.

Deploying a robust Single Sign-On (SSO) solution represents the best answer to this challenge. An SSO allows an enterprise to manage the identities of employees in one place, and delegate access and privileges from there.

Most SaaS providers support SSO integration as it is the most efficient route to centralized identity and access management. The SSO authentication method also enables users to securely access multiple apps and websites with a single set of credentials, which reduces issues like password fatigue, which boosts security, lowers IT help desk load, and increases organizational efficiency.

How SSO works

To get your SSO in place, you need to find the right identity provider. The identity provider is essentially a service that securely stores and manages digital identities. An SSO works based on a trust relationship between the app and the identity provider.

Organizations establish a trust relationship between an identity provider and their service providers to allow their employees or users to then connect with the resources they need. Such a trust relationship is established by exchanging digital certificates and metadata. The certificate carries secure tokens which contain identity information like email address and password, to authenticate that the request has come from a trusted source and to verify identity. 

Although SSO can work with as many apps as the organization wants, each must be configured with a unique trust relationship.

How the Service Provider-Identity Provider relationship works

Once an identity provider is onboarded, every time a user tries to connect to a service provider, the sign-in request is sent to the central server where the identity provider is hosted. The identity provider validates the credentials and sends back a token. If their identity cannot be verified, the user will be prompted to log into the SSO or verify credentials using other methods like a TOTP. Once the identity provider validates the credentials it sends the user a token.

The token confirming the successful authentication is validated by the service provider against the certificate initially configured and shared between service provider and identity provider, after which the user can access the application.

The identity provider verifies the user credentials and sends back an ‘authentication token’ (almost like a temporary ID card) to the service provider. And, of course, all this happens in a fraction of a second.

Advantages of using SSO

  • Simplifies credentials management for users and admin
  • Improves speed of app access
  • Reduces time spent by IT support on recovering passwords
  • Offers central control of password complexity and MFA
  • Simplifies provisioning and de-provisioning
  • Secures the system as information moves encrypted across the network
  • Completely seamless/transparent to the user
  • Easy to add on new service providers

Akku is a powerful identity and access management solution that can enhance data security, efficiency, and productivity across your corporate network through its robust SSO feature. If you would like assistance on ensuring secure access for all your users to your organization’s applications, do get in touch with us.

Single Sign-On and why your organization needs it!

Single Sign-On (SSO) is a session and user authentication service where one set of credentials – typically a username and password – can be used by an organization’s users to access multiple apps. 

SSO delivers tighter control for admins, helping to keep an organization’s data more secure by providing access only to users who really need it. At the same time, it makes operations more secure at the user level too – when users don’t need to remember a large number of credentials, they would be more willing to use stronger passwords.

Besides its inherent security, SSO also simplifies provisioning and de-provisioning, which in effect also increases security by preventing unauthorized access to apps and data.

How secure is your SSO?

Some misconceptions also exist regarding SSO – key among them is that SSO leads to an increased security risk, almost like putting all your eggs in one basket. After all, with one system controlling access across all of an organization’s applications, what if that single system is compromised?

It is therefore important to understand that SSO functions through a system of secure tokens which do not carry any sensitive data, making it a very safe proposition. We’ll explore exactly how this works, and how these tokens ensure security, later in this article.

What are SSO tokens and how do they work?

SSO tokens are tiny sets of digitally signed structured information to ensure mutual trust between parties.

It’s like an exclusive club with select invitees, where guards at the entrance check, approve, and stamp each guest’s hand. Event staff will know the exact shape and color of the stamp used and therefore authenticate the entry. Similarly, in the digital world, the service and identity providers communicate via tokens.

Tokens don’t include sensitive data like user’s password or biometric information, ensuring that any interception or attack on the tokens does not reveal the information. The same token can be used to add on new services to the same SSO platform as well. It facilitates identity verification separately from other cloud services, making SSO possible.

Data Security through SSO

SSO improves enterprise security as it reduces the number of attack surfaces because users only log in once each day and only use one set of credentials. 

It also significantly reduces the possibilities of password-related hacks. With SSO, users only need to remember one password for all their applications. So, they are more likely to create complex and hard-to-guess passwords. They are also less likely to reuse passwords or write them down.

Another reason SSO is popular among enterprises is that it allows scaling up. Both access to new apps and addition of new people can be managed without sacrificing security, because identity and access management are already addressed. And rapid provisioning and deprovisioning without needing to worry about human error means more reliable and secure access management.

For added security, SSO can also be paired with Multi-Factor Authentication (MFA), where additional factors of authentication are required beyond just the user’s password, to reconfirm the identity of the user.

Akku incorporates robust and secure token-based SSO functionality, helping to deliver greater security and efficiency. Contact us today for more information.