Senior Vice President and Head of Identity & Access Management Solutions at HID Global.
Old habits die hard—and so do old passwords. In fact, a 2019 survey conducted by Google found that 65% of people reuse the same password for multiple accounts!
Yet, after decades of dangerous breaches and compromised credentials, the authentication industry stands at an exciting inflection point. Organizations are more aware than ever of the ways that digital transformation is reshaping identity and access management. Consumers, too, are growing savvier about the alternatives to traditional password-based authentication and are more willing to consider using them.
In this article, we’ll unpack these converging trends, drawing from a survey of over 2,700 HID end users and partners.
1. Increased Momentum For Biometric Authentication
Used without thought on cell phones and laptops, biometric authentication is gaining momentum in other areas, as well. In fact, approximately 59% of the security leaders we surveyed said they are using or plan to use biometric authentication in the near future.
And small wonder: From faces to fingerprints, the technologies are fast, accurate, user-friendly and secure. That’s not to say they’ve overcome all obstacles. In particular, misconceptions linger about the way biometrics work.
Sometimes, people are concerned about the collection and storage of biometric data—believing, mistakenly, that systems must store an actual image of their faces or fingerprints rather than encrypted, machine-readable representations.
Other times, people worry that biometric authentication technologies are unreliable and error-prone. Yet according to the National Institute of Standards and Technology (NIST), both fingerprint recognition and iris scanning technologies have achieved accuracy rates of more than 99%. Combining multiple technologies can make authentication systems even stronger—especially when they incorporate behavioral biometrics that identify unique, measurable patterns in the way people interact with their devices.
Still, organizations that are committed to successfully leveraging biometrics will have to be proactive about addressing these misconceptions in order to ensure adoption. They will also have to fine-tune requirements for specific applications, creating solutions that deliver both the security they need and the convenience that users demand.
2. Further Progress Toward A Passwordless Future
We may not be completely “past” passwords, but we have made encouraging progress on the number of applications that rely on them.
Forrester research shows many people assume that passwordless authentication is cumbersome to set up. However, people have also grown increasingly aware of the risks associated with passwords—leading analysts to conclude that multifactor authentication (MFA), in which passwords are only one access factor, may help ease the transition.
Further momentum comes from tech providers like Apple, Google and Microsoft, who are working to expand their support for passwordless authentication and fostering the development of solutions that are more user-friendly than ever—and straightforward for organizations to implement.
Many of those solutions are powered by FIDO, which enjoys strong industry backing and almost universal built-in client support. Deploying FIDO can be done in various ways, either with dedicated hardware tokens known as keys that can be placed on smart cards or with security keys that users plug into a computer or phone to authenticate themselves.
The cryptographic keys that underpin FIDO authentication can also be stored directly on Android and iOS devices—with the help of a FIDO platform synchronized passkey. That means users can authenticate themselves using devices they already have on hand or on nearby desktop computers.
PKI (public key infrastructure) certificates provide another path to passwordless, powering broad, flexible identity management underpinned by a trusted certificate authority (CA). PKI certificates can be provisioned across a wide range of devices, from mobile phones to IoT. PKI requires more careful planning, deployment and management, but it can also be used to encrypt data and end-to-end communications.
According to Forrester, more than 80% of security decision makers report that they are either adopting or planning to adopt passwordless authentication solutions for employees and/or partners. Whether they select PKI- or FIDO-based solutions will depend on their specific needs and infrastructure. Organizations that already use PKI certificates for data encryption, digital signatures or server authentication—or need stricter identity management protocols—may opt for PKI. Those looking for a faster implementation timeline or want to streamline integration with web and mobile apps may prefer FIDO.
3. Rapid Digital And Mobile ID Adoption
From driver’s licenses to employee badges, we’re all familiar with the idea of using a physical ID to verify our identities so we can transact safely, work productively and travel freely. Increasingly, we’re comfortable using digital IDs to do the same.
Users love digital IDs for their simplicity and their convenience. Digital wallets have paved the way to wide consumer acceptance, and adoption is now expanding to use cases that include hotel room keys and even national IDs and passports.
Many organizations are leveraging digital IDs to strengthen consumer authentication, enabling users to authenticate their identities on devices that most people have close at hand. In fact, mobile authentication solutions are among the most secure ways to implement MFA, adding a proven layer of protection to online accounts and services.
These developments haven’t gone unnoticed by the workforce authentication industry, either. According to our research, 66% of organizations have already upgraded to mobile authentication readers—which enable employees to use not just badges and cards but smartphones and wearable devices to access workplace services—while 41% of respondents say that mobile access is one of the top features they’ll look for in a new access control system. Here, too, mobile-first principles are increasingly seen as indispensable.
A few things stand out from our research. First, mobile authentication will underpin and accelerate each of these trends. That’s good news because mobile that plays well with other enterprise technologies is broadly accepted by users and enhances both security and convenience. Second, users must see the value of new identity and access management protocols before they’ll consider switching. So whether you still use passwords or have upgraded to biometrics or FIDO, make sure that’s a part of your earliest strategy discussions.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
