Adopting Zero Trust

Adopting Zero Trust: The Illusion of Passwordless

Aug 10, 2023

The podcast discusses the illusion of passwordless technology and how it is not a new concept. It emphasizes the importance of multifactor authentication for successful cybersecurity. The guest, Derek Hanson, shares insights on passwordless concepts, passkeys, and the split between identification and authentication. The podcast also delves into the significance of physical devices and certificates in security practices, explores vulnerabilities of using MFA through smartphones, and highlights the need to move away from SMS OTP for better security.

51:25

Creator website

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

Strong authentication measures, such as FIDO2 and passwordless multi-factor authentication, can reduce the risk of compromised privileged and service accounts.

Transitioning to more secure authentication methods, like FIDO2, enhances security, saves costs, and improves the user experience compared to SMS OTP.

Incorporating strong security protocols like FIDO2 authentication into contractual agreements can mitigate the risk of supply chain attacks.

Deep dives

The importance of prioritizing privileged accounts and service accounts

It is crucial for organizations to prioritize the security of privileged accounts and service accounts, as they represent the keys to the kingdom. By implementing strong authentication measures, such as FIDO2 and passwordless multi-factor authentication, organizations can reduce the risk of these high-value accounts being compromised. Attention should also be given to managing external identities, including vendors and suppliers, as they can pose significant security risks.

Introduction

3min

Introduction to UBECO and the Focus on Passwordless Multi-Factor Authentication

2min

Journey in IT and Identity: Making Sign-Ins Easy and Secure

4min

Physical Devices vs Digital Devices for Zero Trust and Authentication

5min

Offline Authentication and Vulnerabilities of MFA through Smartphones

31min

Moving Away from SMS OTP for Better Security

7min

The illusion of going passwordless with Derek Hanson, Vice President Solutions Architecture and Alliances at Yubico. You can read the show notes here.

True or False: The concept of passwordless is new. False.

This is shocking, we know.

Considering the amount of hype around the concept, it certainly can feel like a new concept since the masses are becoming more familiar with it; however, the message is a bit jumbled.

For ages, we’ve used things like biometrics (fingerprints or iris scans) and even a PIN to access money on a debit card, but more recently, there has been an increase in misrepresentations about how secure passwordless technology is, simply because there is not a password involved. As cybersecurity practitioners, we know that the simple removal of passwords alone won’t prevent a successful phishing attack, which means multifactor authentication needs to play a role in getting us closer to the Zero Trust concept.

Fortunately, we have a guest this week who is well-equipped to help us navigate the ins and outs of passwordless concepts, passkeys, and the split between identification and authentication. Derek Hanson is the Vice President of Solutions Architecture and Alliances at Yubico, who has spent the last 8 years contributing to the shaping of a physical piece of hardware, Yubikeys, designed to improve authentication. Prior to that, he worked at Costco, focusing on identification and IAM. But first, let’s improve your personal security stack…

Giveaway - Yubikeys!

If you already have a Yubikey, you already know there is always an opportunity for one more in your stack. If you’re new to Yubico’s offering, this is the perfect time for you to grab your very own YubiKey 5C NFC and gain phishing-resistant MFA. It even works with most password managers, too.

To enter, we’ve given you a bunch of options on how you can increase your odds of winning one of two keys. You must be based in the US, though.

[**Enter the giveaway here](https://www.rafflecopter.com/rafl/display/c9435e741/?).**

We’ll close the giveaway in about two weeks and announce it in our next episode.

Get the Snipd
podcast app

Unlock the knowledge in podcasts with the podcast player of the future.

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode

Save any
moment

Hear something you like? Tap your headphones to save it with AI-generated key takeaways

Share
& Export

Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode