In today’s digital world, passwords have become a universal language to access applications and devices. Now, many organizations are looking to employ a password-less strategy.

As I wrote in a previous blog about protecting the user identity and data with Zero Trust and Microsoft Security, let us start with the basics and realize the number one asset under attack: the identity. Today, as organizations continue to plan and strategize the adoption of multi-factor authentication, users continue to authenticate with one-factor authentication via passwords. For some organizations, password policies tend to remain relaxed for the ease of user experience. Especially when logging in to their Windows 10/11 device, Microsoft 365, a third-party cloud app, or a legacy/line-of-business app leveraging Azure Active Directory or Active Directory Domain Services. While a relaxed policy allows more accessible user experiences, it will enable malicious actors to draw an opportunity of deploying simple attack strategies for compromising identities, including but not limited to brute-force attacks and dictionary attacks.

While some systems have built-in security capabilities to prevent simple attacks, let us not forget the sophisticated methods for compromising an identity: social engineering. With social engineering, malicious actors draw out the user with psychological techniques for extracting the necessary data and generating possible passwords to leverage with moderate to high accuracy; this includes baiting, spear phishing, scareware, and pretexting. Of course, a simple password is only scratching the surface. Consider organizations with end-users complaining about the complex password requirements and refusing to use the systems or apps or users who reuse the same password in all systems and apps. The question becomes, “How do you protect the identity with a strengthened security foundation and optimal user experience?”. The answer? Eliminate passwords by defining a password-less strategy.

Password-less login makes it easier for users to sign in securely. It helps support a Zero Trust security model where every access request is authenticated independently of any device state or network location.

While password-less authentication can simplify the user experience, it also supports a Zero Trust security model. Every access request is authenticated independently of any device state or network location. In addition to simplifying the user experience and supporting a Zero Trust approach to security, password-less login makes it easier for IT teams to implement modern identity solutions such as Azure Active Directory (Azure AD).

How do you define a password-less strategy?

As implied, “password-less” indicates methods by which users can log in to respective systems and apps without needing a password. While a password-less strategy may sound impossible, culture and adoption are the primary factors. Imagine the typical user in your organization logging into their Windows 10/11 device with biometrics and/or PIN, already establishing two-factor authentication, and seamlessly logging in to Outlook and Microsoft Teams. Also, imagine the same user using a personal device to log in to Microsoft 365 with only the Microsoft Authenticator app. Finally, consider the field user who needs to log in to an enterprise app that leverages Azure AD as an identity provider and requires two-factor authentication; see the previous example with Microsoft 365!

With that, here are some questions to consider when defining a password-less strategy:

  1. What is the business culture when it comes to leveraging passwords?
  2. How many passwords does a user need to remember?
  3. What is the average number of enterprise apps the typical end-user logs in to daily?
  4. Does our organization already leverage devices for biometrics and or PIN to log in?
  5. How many incidents and requests do your help desk receive for resetting passwords or unlocking accounts?
  6. How many incidents does our cybersecurity team receive for compromised identities due to passwords?

How You Can Build a Better Security Strategy with Password-less Authentication

In brief, Microsoft defined a password-less strategy for all organizations, ranging from small-to-medium to enterprises, and summarizes four (4) steps: 

  1. Developing password-replacement offerings
  2. Reducing the user-visible password surface area
  3. Transitioning into your password-less deployment
  4. Eliminating passwords from your directory services, such as Active Directory Domain Services

    Password Less Strategy

Developing password-replacement offerings

The first step in your password-less strategy journey is determining the best replacement offerings for your organization. Next, consider the technologies your end-users are leveraging today: Windows 10 and 11, Microsoft 365, Azure Virtual Desktop, cloud apps (e.g., Box), and any enterprise apps deployed on-premises. Also, consider what will be convenient to your end-users when logging in to systems and apps leveraging Azure AD or Active Directory for authentication purposes and forms-based passwords.

Let us take Windows 10 and 11 as an example. A replacement for a password-less strategy is Windows Hello for Business, utilizing biometrics (e.g., facial recognition or fingerprint scanning) or PIN. In addition, you can couple these features with a Bluetooth device for two-factor authentication.

Now, let us consider Microsoft 365. Suppose your organization already adopted multi-factor authentication via Microsoft Authenticator. You are just one step closer to enabling password-less authentication and logging into Microsoft 365 from a personal device without a password!

While developing your password-replacement offerings, this is the best opportunity for your organization to structure the journey by identifying the different personas throughout your organizational departments, including IT. Also another factor is identifying all applications and services that leverage a password. The number of personas, departments, and apps in your organization will determine how long it will take to establish a solid foundation for your password-less journey. Still, the best idea is, to begin with, a pilot!

Reducing the user-visible password surface area

As you progress through the pilot and confirm the feasibility of the password-less technologies, the next step is a deep engagement with the personas and departments on the usage of passwords and the comfort level of eliminating passwords for their apps and services. Once the deep dive is complete and understanding the overall use and frequency of passwords for each app and service, the journey continues with developing a mitigation plan. While the easy part is the apps and services already leveraging Active Directory and Azure AD for authentication purposes, the challenge is determining the effort level for applications requiring custom development or vendor support for additional authentication methods. However, once your mitigation plan is in place for all apps and services, engage with the pilot and remove all password capabilities, such as enforcing Windows Hello for Business or removing the password credential provider.

Transitioning into your password-less deployment

If all went well with the pilot and user acceptance testing was successful, the next milestone is taking the remaining personas and departments, deploying the password-less technologies, and eliminating the password surface area. Of course, aside from technology, this milestone requires extensive organizational change management and end-user adoption. 

As you transition the personas and departments into the password-less space, there are essential items to consider: 

  • Organizational change management
  • End-user adoption
  • Awareness campaigns
  • Training sessions
  • Education material

The purpose is to establish a positive atmosphere for promoting the password-less journey, and the benefits received.

During the transition, the IT organization will report and track all issues related to the password-less deployment transition, ensuring gaps do not exist in the deployment and resolution is met with all issues. After resolving issues and remediating gaps, the final step is configuring identities to disallow passwords and enforce the use of password-less technology.

Eliminating passwords from your directory services

As the transition to a password-less deployment is near completion, the final milestone is eliminating passwords from your directory services, such as Active Directory. Today, organizations can accomplish this by removing the password spaces, enforcing the use of password-less technology, and randomizing passwords for all identities, where possible.

Schedule your Free Cloud Security Assessment

Let our certified security experts help with your password-less journey. AIS is a Microsoft Gold Partner with mission-critical competencies and Advanced Specializations, including Cloud Security, Identity and Access Management, and Cloud Productivity. Begin your password-less journey today with an AIS Cloud Security Assessment to help identify and determine your roadmap for a password-less journey, and accomplish your objectives in a reasonable, cost-effective, and secured timeframe.

Whether you start with a Cloud Security Assessment, or if you’re ready to engage a partner to begin your journey to a password-less space, contact us to learn more about how AIS experts can help you.

The Current Situation

Today, organizations continue the transition to cloud computing as part of their digital transformation journey and become highly productive organizations in their respective industry. While transitioning to cloud computing demonstrates agility, scalability, cost-effectiveness, and performance, the challenge is strengthening their security foundation and reducing risk. While vendors, such as Microsoft, provide the best-in-class measures and features for tightening the organization’s security foundation, the ultimate responsibility belongs to the specific organization. Of course, organizations will take precautionary steps for protecting device assets and data from malicious exfiltration and theft. Still, organizations tend to loosely protect the number one crucial asset: the user’s identity. As reported by Microsoft, cybersecurity experts detected and reported 15 million attacks, scoped to password-based attacks alone. This is a signal that the user’s password is the primary target! So, the big question is…how does an organization protect the user identity, device assets, and corporate data, preventing compromises and breaches? The answer: Zero Trust.

What is Zero Trust?

Top cybersecurity experts and leaders changed the game with the introduction and indoctrination of Zero Trust, revealed as the top method to protecting identities, assets, data, and the overall organization. First, let’s start with the basics: what is Zero Trust?

Microsoft clearly defines Zero Trust by following three objectives:

  • Verify explicitly
  • Use least-privileged access
  • Assume breach

To summarize, treat every request as if it came from an unknown network and always verify.

Zero Trust Foundation

Verify explicitly – the user identity is the key to accessing organizational data and assets. Therefore, the first step is to verify the identity belongs to the user accessing the data—Azure AD supplements this concept with Conditional Access and leveraging security features, such as multi-factor authentication.

Ask yourself these questions:

  • Is the user accessing the data from the correct device to take it a step forward?
  • Is it in the correct location?
  • Is the user now at high risk?
  • Is the device at high exposure due to an existing cybersecurity incident? Is the device compliant?

Use least-privileged access – not a new concept, but not a heavily practiced concept. Specifically, in Microsoft 365, organizations utilize privileged identities for administrative functions and operations. However, remember that organizations do not separate privileged access from their regular accounts and leave a permanent assignment for privileged access even if the identities are separate. Also, some organizations allow users to consent for apps accessing Microsoft 365 data. Azure AD offers features to reduce the risk revolving around privileged access and tracking identities. For example, Azure AD Privileged Identity Management, Microsoft Defender for Identity, Conditional Access, Azure AD Identity Governance, Azure AD Identity Protection, Microsoft Information Protection, and more.

Assume breach – As any cybersecurity expert, vendor, or leader will tell you, an organization will never reach 100% hardened as malicious actors and attackers continue to develop sophisticated attacks. Therefore, the organization must adopt the “assume breach” mindset and always defend themselves. Thus, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Cloud App Security protect the organization from modern attacks, allowing an organization to become proactive and leverage advanced hunting features to prevent future malicious attacks. Other methods of adopting the “assume breach” mindset are reviewing user sign-in risk, device health risk and exposure, threat and vulnerability management, device & user identity hygiene, and more.

Why Microsoft Security for Zero Trust Foundation?

In brief, Microsoft defines security under four (4) pillars: protect everything, simplify the complex, catch what others miss, and grow your future.

Safeguard your people, data and infrastructure

The four (4) pillars outline the overall position on Microsoft Security and the value it demonstrates for all customers: simplifying the Zero Trust foundation. In addition, Microsoft Security is proving its firm establishment in the cybersecurity field by being a prime leader in seven (7) Forrester Wave reports, and five (5) Gartner Magic Quadrant reports.

Microsoft Security a Leader in Gartner Magic Quadrant

Microsoft Security

Microsoft Security continues to develop an end-to-end approach, integrating with a total of 53 essential categories around the cybersecurity landscape. It also demonstrates cost savings with Microsoft security solutions covered under Microsoft 365 E3 and Microsoft 365 E5 licensing tiers, compared to competitors in cybersecurity, such as Symantec, Cisco, and CrowdStrike.

Integrate up to 40 categories

Enhanced Microsoft Security

How Can AIS help?

As a Microsoft Gold Partner, AIS contains the expertise and skills to assess, guide, and deploy the Zero Trust foundation from leveraging the solutions from the Microsoft Security foundation, such as Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Cloud App Security, Microsoft Information Protection, Azure AD Privileged Identity Management, and more. Below is the Zero Trust Guidance Center from Microsoft. Consider AIS for assistance on this journey for your organization to be at an optimal state of the Zero Trust foundation!

Zero Trust Guidance Center: Zero Trust Guidance Center | Microsoft Docs