{"id":43149,"date":"2021-09-30T16:00:46","date_gmt":"2021-09-30T16:00:46","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=97878"},"modified":"2021-09-30T16:00:46","modified_gmt":"2021-09-30T16:00:46","slug":"3-key-resources-to-accelerate-your-passwordless-journey","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/3-key-resources-to-accelerate-your-passwordless-journey\/","title":{"rendered":"3 key resources to accelerate your passwordless journey"},"content":{"rendered":"

Every organization today faces password-related challenges\u2014phishing campaigns, productivity loss, and password management costs to name just a few. The risks now outweigh the benefits when it comes to passwords. Even the strongest passwords are easily phish-able and vulnerable to attacks, such as password spray and credential stuffing. People don\u2019t like them either\u2014a third of people surveyed<\/a> say they\u2019d rather abandon a website than reset their password. \u201cI don\u2019t have any more passwords left in me,\u201d is becoming an all-too-common feeling. It\u2019s time to look at password alternatives that are both highly secure and convenient. Here\u2019s a few key resources that can help you as you plan for and deploy passwordless<\/a> for your organization.<\/p>\n

1. Preparing your organization for passwordless authentication<\/h2>\n

Today, the technology exists to make sign-ins simpler and more secure. Two protocols, WebAuthn and CTAP2, form what is known as the FIDO2 standard\u2014which enables organizations to upgrade their authentication methods to strong hardware-backed multifactor authentication<\/a> options that don\u2019t rely on passwords at all. Instead, you can use a physical key, laptop, or mobile app as your credential. Two questions customers often ask are which method do I choose and how do I get started?<\/p>\n

I recently published an update to our Passwordless Protection whitepaper<\/a>, which breaks down the different authentication methods, adoption strategies, and use cases. This guide gives you a great starting point for thinking through your strategy and a foundational understanding of how passwordless authentication works and the requirements for each of the options.<\/p>\n

\"Workflow<\/p>\n

10 reasons to love passwordless<\/h3>\n

This year, my colleagues also created a series of blog posts 10 reasons to love passwordless<\/a>, which expands on many of the concepts in the whitepaper.<\/p>\n

    \n
  1. FIDO2-based credentials<\/a> developed and adopted by the industry.<\/li>\n
  2. Compliance with the National Institute of Standards and Technology (NIST) Authenticator Assurance Levels 2 and 3 (AAL2 and AAL3).<\/li>\n
  3. Biometric authentication stored locally to uniquely and securely identify users.<\/li>\n
  4. Faster sign-ins with Windows Hello<\/a> built into your PC.<\/li>\n
  5. Portable security keys in a variety of form factors that work across platforms.<\/li>\n
  6. Helpdesk savings from password reset requests.<\/li>\n
  7. Convenient sign-ins with Microsoft Authenticator app<\/a> on your smartphone.<\/li>\n
  8. Phishing-resistant credentials that reduce risk of compromise by over 99.9 percent.<\/li>\n
  9. Easy setup and recovery of passwordless credentials with Temporary Access Pass<\/a>.<\/li>\n
  10. No passwords needed for users to be productive and secure.<\/li>\n<\/ol>\n

    2. Planning your passwordless deployment<\/h2>\n

    Check out the passwordless authentication deployment guide<\/a>, which goes in-depth into how to plan the project, deploy different methods, and manage policies for passwordless authentication based on what we\u2019ve learned from thousands of implementations with customers. Use the passwordless recommendations tool<\/a> in the Microsoft admin console to help you choose the right method for each of your audiences.<\/p>\n

    \"Password<\/p>\n

    You can also get a hands-on tour of passwordless capabilities in Microsoft Azure Active Directory from the video Microsoft Mechanics<\/a> with Joy Chik, Corporate Vice President, Identity and Network Access, and host Jeremy Chapman.<\/p>\n

    \"Screenshot<\/p>\n

    3. Learning from experts<\/h2>\n

    Data is useful, but sometimes you want to hear from people with experience. Join security experts on Wednesday, October 13, 2021, from 10:00 AM to 11:30 AM Pacific Time<\/strong> for Your Passwordless Future Starts Now<\/strong><\/a>, a digital event where you\u2019ll learn more about passwordless authentication and best practices for adopting an organization-wide passwordless strategy.<\/p>\n

    You\u2019ll learn how to:<\/h3>\n