Every new layer of protection introduces more challenges. (Image: Datacentrix)
Authentication has come a long way over the past decade. Organisations have moved away from relying exclusively on passwords to implementing multi-factor authentication (MFA), while passkeys are now emerging as the next evolution in identity security.
Each of these developments has certainly strengthened security and made it more difficult for attackers to compromise user accounts. However, every new layer of protection introduces more challenges, whether they be around usability, recovery processes, interoperability or identity management.
As authentication continues to evolve, businesses must think past deploying the latest technology and consider not only how these solutions work in practice, but also where new risks may emerge.
While companies continue to mature their security practices, increasingly stringent password requirements can unintentionally drive poor password hygiene.
People are asked to create passwords that are a certain length – usually 12 characters or more – with a certain level of complexity, while avoiding repetitive strings and rotating them every 60 to 90 days. At the same time, they are expected to remember all of these passwords without writing them down.
For the average human, that is extremely difficult. And the challenge becomes even greater when most users have multiple systems to log into, all requiring the same level of complexity.
Because it is so difficult, people naturally start looking for workarounds and shortcuts. A user may choose one suitably strong password they like and then make incremental changes to it. The problem with this approach is that attackers understand these patterns and their breach scripts are designed to try these variations automatically.
Patrick Munsami, Security Architecture and Engineering Manager at Datacentrix.
Other common practices include writing passwords down, re-using the same password across multiple systems or storing passwords in text files on computers or unencrypted notes applications on mobile phones.
As humans, we are wired to choose the path of least resistance most of the time. We also tend to judge password security based on the perceived value of the information being protected, which can lead to the misconception that personal information is not as valuable as corporate information. This is certainly not the case.
The danger is that once individuals become comfortable with a particular password pattern, they often use it outside the enterprise as well, perhaps on forums, blogs or subscription sites. When one of those platforms is compromised, the strength of the password is effectively reduced to nothing.
The widespread adoption of MFA has significantly improved identity security. Even if an attacker steals a password, they still require a second authentication factor to gain access. This means that stolen username and password combinations purchased on the dark web are no longer enough on their own.
MFA can also mitigate phishing attacks to some extent. Even if a user unknowingly enters credentials into a fake login page, an attacker would most likely still be unable to complete authentication, depending on the second factor being used. Hardware security keys, for example, are particularly effective because they cannot easily be copied or stolen through phishing pages.
In addition, many compliance and regulatory frameworks now require MFA, making it an important control for organisations that need to meet audit requirements.
However, not all forms of MFA provide the same level of protection. Some companies still rely on SMS-based authentication, which remains vulnerable to SIM-swapping attacks. Authenticator applications can also introduce recovery challenges. If users lose or replace their phones, the recovery process is often less secure than the original authentication process itself.
In fact, in many cases, recovery may require only e-mail verification and personal details, which attackers can potentially exploit to bypass MFA protections.
Another challenge organisations face is cyber security fatigue. Every day, users are required to enter usernames and passwords, approve biometric prompts, retrieve one-time passwords and repeat the same process again and again across numerous systems and applications.
Initially, users may be vigilant and attentive, but eventually desensitisation sets in. People become used to clicking through multiple prompts simply to gain access, which could lead them to progress from being vigilant to annoyed, then numb, and eventually reckless.
At that point, a carefully crafted phishing attempt that looks like a genuine login page can easily trick someone into giving away their credentials. The consequences can be significant because it potentially gives an attacker direct access to organisational systems.
The same fatigue can also affect internal security teams. Security operations centre (SOC) analysts process enormous volumes of alerts every day, many of which look very similar. Over time, the same desensitisation process can occur. An analyst who initially investigates every alert carefully may eventually stop paying such close attention to repetitive notifications and incorrectly classify a genuine threat as a false positive.
Whether it affects users or security analysts, fatigue can create opportunities for attackers that businesses need to recognise and address.
Passkeys represent an important advancement in authentication because the underlying technology, based on private and public key cryptography, is highly secure. However, they are not the complete answer.
There are practical considerations around adoption. Passkeys tied to one ecosystem do not always integrate smoothly with others, while cost and adoption remain barriers for many organisations.
From an enterprise perspective, companies also need to consider how passkeys fit into joiner, mover and leaver processes. They should think about how passkeys are issued to new users, how they are revoked when employees leave and, perhaps most importantly, how they verify that an individual is genuinely who they claim to be before issuing credentials.
This becomes particularly challenging in remote and hybrid working environments, where face-to-face identity verification is not always possible.
Furthermore, the same criticism levelled at two-factor authentication can also apply to passkeys. The recovery and reset processes are often no stronger than those used in MFA systems today.
Until those recovery processes mature further, a hybrid model using both passkeys and MFA together is likely to provide the strongest approach.
Authentication technologies will continue to evolve, but implementing them successfully involves far more than adopting the latest innovation. Every advance strengthens security but it also introduces new operational considerations, from recovery processes and identity verification to user life cycle management. Businesses that recognise and plan for these realities will be better placed to strengthen identity security without creating new vulnerabilities in the process.
To learn more about Datacentrix’s cyber security services offering, please visit https://www.datacentrix.co.za/cybersecurity-services.html.