Jing Gu, Sr. Product Marketing Manager, walks us through enterprise-ready deployments of passwordless authentication.

Transcription

Hi, my name is Jing Gu, I work at Beyond Identity. And today, we're going to talk about enterprise-ready deployments of passwordless authentication. 

We'll go through what all of that means. But when we speak of passwordless, we cannot talk of it without mentioning the fundamental standards that undergird passwordless authentication today, which is the FIDO Alliance. So, FIDO stands for Fast Identity Online, and it is both a certification agency. You know, they have FIDO WebAuthn, CTAP, UAF. 

They assess for security and interoperability as part of their certification, as well as an industry alliance of like-minded companies who care about bettering digital access for all. Some of these companies in the Alliance, you may have heard of before, like Google, Apple, and Microsoft. 

So, this is the foundational building block of passwordless, right? So, Beyond Identity has been part of the FIDO Alliance since 2020, and we were officially FIDO2 certified in 2023. How does Beyond Identity make passwordless enterprise deployable? Well, passwordless authentication also needs to be easy to use. 

So, this is the first part of how we support and extend FIDO, and this is within the category of passwordless authentication. So how do we extend and support FIDO specifically? Well, passwordless authentication should be zero friction, and the way to achieve zero friction is to make sure that the user is only using one singular device to authenticate, that there's no second device involved, which also, you know, when there's second devices involved, there's also a security risk involved with that. 

Additionally, there's a component that is really important to deployment, which is universality. And what this is referring to is, currently FIDO support. So, WebAuthn support is uneven across different browsers, different devices, and what we do is we say we're going to abstract all of the complexities of compatibility issues and allow you to deploy passwordless authentication that is consistent across any device, OS, and using any identity protocol such as OIDC, OATH, SAML, and SCIM. 

Great. So once you complete this passwordless authentication story, authentication is the front door to your products and services, so you better be thinking about security, and this is where the security piece comes into play. 

With Beyond Identity, we offer a phishing-resistant... This is a fish hook, so there's no phishing allowed. We offer phishing-resistant multi-factor authentication. And what we mean by that is there is no phishable factors. In fact, we only use local device biometrics, this is my poor attempt at a fingerprint, as well as a passkey, which is a public-private key pair. 

So I'll draw a little key here. What's unique about our passkey is the private key is secured in the TPM or the trusted computing environment of modern devices. This private key is never synced to the cloud, this private key cannot be tampered with, modified, or otherwise copied off of the device, and this gives you the assurance that it is an authorized and trusted device that is trying to gain access to your services. 

So I'll just label this as device bound. Great. So at this point, you got FIDO at the foundations, you have passwordless authentication that makes your users really happy, and you have phishing-resistant MFA. The work is still not done because we now have this concept of zero trust in which you should never trust and always verify. 

So, in the context of zero trust, what does authentication look like? Let me just write out zero trust auth here. All right, well, the first thing that it means is you need to have visibility and control over all of the endpoints in your fleet, including bring your own devices. So, every authentication request that Beyond Identity does, we're also performing a security check. 

So, is the firewall turned on? Is the biometric enabled? Are the MDMs configured and active on this device? Every device that authenticates must pass these real-time device security checks in order to gain access. 

And of course, we give you the logs that are immutable to prove this. So, once you have all of this, right, Zero Trust authentication, never trust, always verify, also involves a time element because just because you authenticate a user once and their device passes the initial checkpoint, does not mean that that device stays in compliance forever. So for example, a user may turn off their firewall by accident or otherwise compromises their device security posture. 

And that is where continuous authentication comes in. And continuous authentication means that even during authenticated sessions, you can verify that it is still the correct user using a trusted device trying to gain access to your critical services and data. All right, so that is the final strata of the authentication stack that we offer. One important note about Zero Trust authentication, it takes a village, right? 

So, we also provide out-of-box integrations with MDMs, so your endpoint protection tools, EDRs, next-generation EDRs, XDRs, your Zero Trust Network Access tools as well as your SIEMs and your logging tools. 

And in the SIAM scenario, maybe you have a CRM, your fraud tooling, etc. So, all of this feeds into, and we push data out of our platform into these tools. So, this is how Beyond Identity supports and extends FIDO authentication, and we make sure that this is really easy to deploy by giving you a...and this is my attempt at a cloud, here it goes. 

All right, that looks like a cloud, right? This is a cloud-native SaaS platform, and we make it easy to deploy, secure, frictionless zero trust authentication across your entire user base, including your workforce, and contractors and partners, your customers. So, this is your end users. 

And within the workforce, you might want to protect your crown jewels, aka your code repository. So, we also offer a solution to protect your developers. And that is how Beyond Identity enables enterprise-ready deployments of passwordless authentication that is secure and aligned with Zero Trust. 

Thanks for tuning in.