We all hate passwords. That’s not a revelation. We all have too many, we can’t keep track of them, they are the top source of breaches, they cost organizations billions and Verizon reminds us every year of this!

So why are they so difficult to get rid of?

For the most part, it’s because up until recently there was nothing better. Passwords – a shared secret – provide a common way to authenticate across any device. But it’s a single factor that is easily compromised and no longer practical in our digital world where we have to remember, on average, 90 of them. To get around the inherent security weaknesses and user experience issues, companies have invested in risk signals, OTPs, session cookies and other add-on strategies. But at the end of the day, there is still an underlying password that can be compromised, and causes user friction.

The good news is that over the last 5 years, the fabric of identity and authentication has been undergoing a wholesale upgrade from username and passwords to cryptographic keys – aka FIDO. What that means is that you can replace 2 weak factors (for example passwords and OTPs) that are both vulnerable to phishing attacks (and both add friction!) with a strong multi-factor approach that is more convenient and more secure at the same time. Those factors are 1) the device that people already have (their phones, their PCs, their tablets) that are now cryptographically bound and 2) the user verification performed by the device (e.g. fingerprint sensor, facial recognition, PIN).

The FIDO protocols make it possible to replace passwords with strong multi-factor authentication that is very user friendly – a swipe of a finger, a look into your phone’s camera, typing your Windows Hello PIN, etc. Most users prefer these alternatives – Apple made them popular when they introduced TouchID. Most companies have implemented biometrics in their mobile apps to alleviate some of the password friction. Very often, however, the password is simply cached so that approach provides no improvement to security. And, when the user authenticates to the web version of an application either on their phone or PC, they’re back to… you guessed it… the annoying password.

Up until last year, one of the excuses for sticking with passwords was that Apple wasn’t on board yet with FIDO – so the puzzle was incomplete. That’s no longer the case as Safari now supports FIDO – joining Microsoft, Google, and Firefox Mozilla in the quest to eliminate passwords. Now that FIDO adoption across the ecosystem makes it practical to extend the “TouchID” concept to any device and channel, we can finally scrape off the gum. Can’t we? The challenge is that while it seems like a no-brainer – easier, more secure — it’s a change. Digital transformation requires cross functional support. Each stakeholder must understand the value to their organization, and why it makes sense to take a strategic, new approach versus more tactical add-ons. The organization must also have a clear roadmap for moving from the legacy approaches to the new paradigm — what I call “transition vision”.

Stay tuned for my next blogs where I’ll discuss aligning internal stakeholders on the many business benefits, the value of a strategic approach, as well as best practices for embarking on your journey to passwordless.

A tragic milestone has been crossed this year. While, yes, the tragedies do seem to be manifold – one tragedy in particular stands out in our field. The first death linked directly to a cyber attack.

Earlier this year, in Dusseldorf, Germany – not three hours from my home – a ransomware attack crippled a hospital’s systems, requiring all ambulances to be rerouted to other emergency rooms. One ambulance, however, did show up at the targeted hospital with a patient in critical condition. The patient did not survive the rerouting to an alternative facility.

This is tragic. Threats in the digital world have made the jump to the physical. The threat to people is no longer theoretical or about personal inconvenience. They are no longer about a simple rejection of a fraudulent payment. Unfortunately, the threats seem to be multiplying.

Since the beginning of the COVID-19 pandemic, online crimes have roughly quadrupled.While hospital in Dusseldorf may not have been the the intended target, hospitals are quite vulnerable. In 2019, it was reported that 84% of hospitals didn’t have a full-time cybersecurity employee. The same report noted that, between 2016 and 2018, one-third of hospital executives purchased cybersecurity tools “blindly without much vision or discernment.” Meanwhile, healthcare organizations spend more than all other sectors on data breach recovery.

It is a mixed blessing, then, that internet-connected devices – the internet-of-things (or IoT) – have been a boon to the healthcare industry. Doctors and employees use smartphones, tablets, laptops and digital assistants already. There is growing connectivity among diagnostic and imaging equipment, surgical robots, wearables, intelligent equipment and countless wireless sensors. There are bluetooth enabled weight scales and blood pressure cuffs that track symptoms for cancer patients. There are glucose monitors that improve the quality of life for diabetics. Apple’s ResearchKit simplifies the daily diary process for those who suffer from Parkinson’s Disease – helping both the patient and providing valuable data to assist in research. Even your smart refrigerator could send relevant data back to your doctor about your diet.

All of these innovations have been a net-benefit for the quality of healthcare that we receive. Alan Mihalic, president and founder of the IoT Security Institute, has noted that “with all this data, can look at how to improve their service and lower the cost to deliver that service. But moreover, it’s a question of moving from a reactive to a proactive healthcare model.”

With all of these new devices, coming from different manufacturers, installed and run by smart medical professionals who may or may not have IT security experience – it’s no wonder that the hospital’s attack surface has grown immeasurably in the last few years. 92% of the purchasing decisions regarding data security between 2017 and 2019 were made at the C-level and didn’t include the affected department managers nor the users that would be impacted by such decisions. Across the industry, there is almost no reliance on secure authentication – after all, the urgent nature of hospitals require a system that provides relevant information to an emergency room doctor on demand.  Additionally, hospitals are notoriously plagued by budget constraints. Replacing or upgrading legacy software tends to come with a price tag leading to outrageous statistics like: 56% of healthcare providers still use Windows 7! What money there is for IT is usually not earmarked for security. 90% of institutions report that their security budgets have remained level or decreased since 2016.

But what can be done about it? It is vital to be aware of current best practices.

In 2019, the National Institute of Technology Standards (NIST) published a report, NISTIR 8828, detailing “Considerations for Managing Internet of Things Cybersecurity and Privacy Risks”. In it they highlight three high-level methods of mitigation. Simply put, they are:

1. Protect device security.
2. Protect data security.
3. Protect individuals’ privacy.

Those responsible for outfitting and managing a hospitals IT infrastructure need to be thoughtful about the way in which they incorporate connected devices. Mitigating cyber risk is crucial for any industry, but there is no room for error in healthcare. The rapid shift this year to remote work has opened a significant number of vulnerabilities for hackers to exploit. Unfortunately, fixing vulnerabilities is much more difficult than it sounds, especially for an always-on operation like a hospital.

But it is possible to start at the beginning. Authentication – the process by which we gain privileged access to devices and records – that can be secure, frictionless, interoperable with other devices and based on industry tried-and-tested standards can begin to close the gap in these vulnerabilities. Unfortunately, it would require challenging the status quo – a status quo that carries with it significant inertia.

But, with human lives at stake, it is clearer than ever that the status quo is not good enough and needs to be challenged.

As this is cybersecurity awareness month, let us all take a moment to consider our underlying assumptions and where we might be able to improve them. IoT devices in healthcare can provide significant improvements in how patients are treated and how research is done. But it needs to be protected and “good enough” security of the past is simply not good enough anymore. At least, it wasn’t for that patient in Dusseldorf.

It is not a surprise to say that passwords are broken. They were not designed to secure today’s connected economy. As an inventor of FIDO standards, we knew that the key to replacing passwords was a privacy-by-design specification that championed interoperability and decentralized the security topography.

The Nok Nok™ S3 Suite goes beyond the standards. It is the most widely deployed FIDO-certified solution on the planet. It has powered billions of consumer authentication events for banks like BBVA and Standard Bank, for telcos like T-Mobile and NTT DOCOMO, and for a variety of other industries like physical security, government and insurance. We have deployed the Nok Nok solution, at scale, more times than any other purveyor of FIDO certified servers. Our level of experience delivers a better product, a better team, a swifter and more stable integration, and a collection of benefits we are excited to share in this new release of the Nok Nok S3 Suite.

Adaptive Policies
Existing authentication systems are robust – but most have been deployed using username and passwords as their foundational layer. We know that passwords do not make a firm foundation. In order to shore up that weakness, new systems have been bolted on to make the passwords more complex, to ask personal questions, to generate and distribute one-time-passcodes or harvest device details in order to lower the probability of fraud (just a little!). Risk-engines were devised to collect and analyze these data points. Regulations have been created mandating the use of these additional methods. As we move into a passwordless future, some of these requirements persist and will still be needed.

With the Nok Nok S3 Suite you can power large scale passwordless deployments – deployments which can be paired with existing risk engines, behavioral biometrics, or other systems. With our new release, we simplify the integration and add an engine capable of dynamically adapting to the context of an authentication event. This allows our customers to select appropriate risk factors and implement them without writing a single line of code. By including authentication context, we help enable compliance with the requirements of PSD2 SCA, and other privacy and security regulations. The new, simplified integration accelerates time to deployment and provides the tools necessary to address the most pressing financial industry requirements.

Expanded Device Support
Since the beginning, FIDO standards have been about interoperability. We worked tirelessly in the early days to make sure the standard integrated with handset manufacturers like Fujitsu and Samsung, secure silicon providers such as Qualcomm, and authentication providers for facial and fingerprint recognition. Nok Nok was the first to bring FIDO authentication support for the Apple Watch and today we are happy to let you know we now also support WearOS (formally Android Wear). But our work is not done. As new devices and solutions come to market, we are eager to expand our support and bring more choices to the consumer. Through our API and SDKs, the same user experience and security can be provided, regardless of channel or device.

Nok Nok™ Quick Authentication
Bandwidth is crowded, especially now that more of us are online with multiple devices. Phones are connected to earphones, watches, computers and more. Each wireless interaction carries a network cost and introduces delay and latency to the customer experience. Some networks are not as robust as others and this inconsistency of experience can create frustration and friction for users.

Following our history of designing “beyond the standard”, today we are introducing Quick Authentication with this latest release. Nok Nok™ Quick Authentication performs secure FIDO authentication in a single network round trip. Organizations can now significantly reduce their network traffic. End-users get both speed and security with this update.

Going Beyond
While FIDO standards are a leap forward towards a passwordless world, the Nok Nok S3 Suite takes you there and beyond. Our latest technology is built to address the authentication needs of companies wrestling with regulatory complexity, without adding friction to the user experience. Customers expect privacy, and regulations – such as CCPA and GDPR – have strict rules and significant penalties for privacy violations. The Nok Nok S3 Suite eliminates the need to centrally store biometric customer data for authentication and – as mentioned – it follows a privacy-by-design approach. With strong, multi-factor authentication, the ability to comply with FFIEC, PSD2 SCA, HIPAA and other regulations is enabled. In addition, support for EMVCo 3DS2’s requirement for transaction confirmation of high value transactions is already included.

We view authentication as the front door to the connected economy. That door should be frictionless, yet secure. It should provide the security an organization and regulatory body requires while not turning away the end-user. We have deployed our solution to customers with tens of millions of users and we know how to build and integrate a scalable solution.

Simple. Secure. Scalable – was what we committed to 8 years ago and what we continue to deliver today.

For more information on the Nok Nok S3 Suite reach out to our team who will be happy to answer any questions.