Reducing our reliance on passwords to boost security

Data breaches remain a serious threat to every business. In 2023, about half of them reported experiencing a data breach, according to the Data Breaches Investigations Report. In the United States, more than 90 million accounts were breached in the third quarter of the year alone, per data breach statistics tracked by Surfshark. 

When it comes to preventing data breaches with secure authentication, passwords can be a serious problem. That problem is seriously compounded by the fact that so many businesses still rely on them to provide secure access.  

There are several understandable reasons passwords are the norm. For users, passwords are familiar, convenient, and easy to understand. For administrators, passwords are easy to implement, supported by existing infrastructure, require no new hardware, and cost nothing. As a result of those factors and others, nearly all the devices and services we use require password authentication.  
 
For hackers, however, passwords are vulnerable, valued, and valuable. Passwords can be cracked by humans or bots. They can be accidentally exposed. They can be stolen in one data breach and used to execute many other additional breaches. 

It makes sense to reduce our reliance on passwords and to consider alternatives, but it’s also important to remember the reasons so many businesses rely upon them, as we try to supplement or replace them. To ensure a seamless and secure authentication experience for users, top priorities for administrators when considering alternatives to passwords should include security, usability, and scalability.

Here a look at other types of authentications that can help your business boost security and reduce overall reliance on passwords.

Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA)  

2FA and MFA are the current security default for most applications. With 2FA, users must provide two forms of identification to gain access. Typically, one item is something the user knows, such as a password, and the second item is something they need to have, such as a code sent to an authentication app on their mobile device. It takes very little time and effort for users to sign in. MFA adds additional layers of authentication to the process, such as biometrics or behavioral biometrics. To try to breach MFA, hackers use targeted phishing, along with MFA fatigue attacks, also known as MFA Bombing and MFA spamming.

Single Sign-On (SSO) 

With SSO, users can access multiple applications with just a single set of login credentials. For users, SSO eliminates the need for many passwords and simplifies the sign-on experience. For administrators, SSO can be very effective when it comes to internal business applications, but it can take a lot of time set up and to connect users. SSO can also be risky. If an attacker gains access to an SSO account, they also have access to all applications, data, environments, and systems linked to that account. For that reason, SSO can be especially risky when it’s used for widespread internet activity and gaining access to online services, such as Facebook, Google, and Microsoft.  

Biometric authentication 

The most popular biometric authentication methods include fingerprint, facial, and voice recognition. (Iris scanning is a less common method.) Biometric authentication provides two noteworthy benefits: it’s highly secure and easy to use. For users, it’s a fast, simple, and smooth experience. They are already familiar with how biometric authentication works because some consumer devices use those capabilities. For example, facial recognition is used to unlock the latest versions of the Apple iPhone. Plus, they don’t have to remember a password, the answer to a security question, or anything else. For administrators, the required technology can be costly to implement. Also, there can be technical limitations, as not every device is able to facilitate biometric authentication. 

Hardware tokens 

A hardware token is a small device that typically looks like a USB flash drive. To add an extra layer of security, a hardware token generates a one-time, time-limited code or cryptographic key to enable authentication. To infiltrate an account, an attacker would have to know the user’s log-in credentials and have physical access to the device.  

Certificate-Based Authentication (CBA) 

Certificate-based authentication (CBA) uses cryptographic digital certificates to verify the identity of users, devices, or machines, before allowing access to applications, networks, or other resources. Unlike some authentication methods tailored to users, such as one-time passwords (OTP) and biometrics, certificate-based authentication is applicable across all endpoints, including servers, personal computers, e-passports, and any device falling within the realm of the Internet of Things (IoT). 

Risk-Based Authentication (RBA) 

Risk-Based Authentication, often referred to as context-based authentication, is the procedure of confirming a user's identity during sign-on by evaluating them against a predefined set of criteria. Access to resources is then either permitted or denied, based on the determined level of risk. RBA can take many different factors into account, including time of day, location, device and browser info, IP address, user information, and the context of the request. 

To boost security and make it easy for users to log in, more businesses are relying on passwordless access methods, including these alternative and supplementary authentication methods. Many of these methods are often used as part of a larger Zero Trust Access approach. Both passwordless access and Zero Trust help businesses effectively safeguard their assets from the evolving threats in today’s cybersecurity landscape.