Cyber Essentials and passwordless authentication
Passwordless authentication is gaining traction as organisations seek to address the long-standing issues with passwords, their management, and the user experience. Security standards such as the NCSC’s Cyber Essentials require businesses to implement Multi-Factor Authentication (MFA) to protect access to systems and data.
Table of Contents
Traditionally, MFA has combined something you know (a password) with something you have (such as a smartphone and authenticator app), or something you are (biometrics like a fingerprint or facial recognition).
This raises an important question: if government and industry bodies are recommending a move to password-less authentication, how does this align with compliance requirements like Cyber Essentials?
In this blog, we’ll explore the risks posed by passwords, why organisations are adopting password-less approaches, and how to make the shift securely without compromising your certification.
The risks and challenges of passwords in Cyber Essentials
Passwords have been a foundational part of security for decades now. Yet, it remains to be one of the weakest links in a business’s armour, from the use of weak passwords, poor handling and storage hygiene, to the reuse of the same passwords across multiple platforms.
The rise in password managers has been an attempt to provide users with a safe place to store their passwords and solve the very human problem of recalling long, complex passwords. Whilst this does reduce the risk of a password being reused, the problem has not been completely solved.
What is passwordless authentication, and how does it work?
That’s why more companies are moving towards password-less authentication. Password-less authentication replaces traditional passwords with methods such as biometrics, security keys, or push notifications.
It can significantly reduce risks from weak, reused, or stolen passwords, while often improving user experience. That said, it is not a silver bullet and can introduce its own weaknesses if not implemented properly.
Does passwordless authentication meet Cyber Essentials MFA requirements?
Password-less authentication may seem like it breaks the principle of MFA, but in fact, it can make the authentication control stronger by removing the weak link in the chain, the password.
Standard MFA combines a password with another factor, such as a code provided by an app on your mobile. Password-less simply replaces the password with a private security key on your end users’ devices, combined with something you are (biometrics, Windows Hello), something you know (e.g., PIN), and authentication.
What feels like a single-step login is still Multi-Factor, making the login process a much lighter touch for the end user. Let’s look at an example.
Your end user logs into their laptop using Windows Hello or their fingerprint (something they are), which is used to unlock a private key stored only on that laptop (something they have). If an attacker were able to obtain the laptop, they would not be able to unlock it due to the biometric security.
Similarly, if a user receives a push to their mobile authenticator app, they would authorise the push notification by unlocking their mobile with biometrics or a PIN, again satisfying the requirement for MFA.
Cyber Essentials authentication requirements: passwords vs passwordless
The Cyber Essentials requirements previously outlined that the following should be in place when accessing a device or company resource.
Cyber Essentials Requirements for IT Infrastructure v3.2
Password-based authentication
- A minimum password length of at least 12 characters, with no maximum length restrictions
- Using multi-factor authentication
- A minimum password length of at least 8 characters and the blocking of common passwords.
Password-less authentication
Password-less authentication is now accepted as a form of authentication. This is a method of using either of the following in place of a password when logging into a device.
- Biometrics – User traits such as facial features or fingerprints
- Security keys and tokens – USB security keys or smart cards
- One-time codes – Temporary codes sent via email, SMS, or mobile apps
- Push notifications – Using a smartphone app to approve or deny login attempts
What passwordless authentication means for Cyber Essentials compliance
Allowing an additional form of authentication enables a business to choose the method that best aligns with its current setup. As security evolves, companies seeking to leverage the capabilities of their existing operating systems can benefit from implementing password-less settings, which offer strong protection while remaining compliant with CE guidelines.
Cyber Essentials support and passwordless compliance guidance
Evalian can assist with navigating the new changes. If you are renewing your certification or this is your first time, we can offer expert guidance and support to achieve CE.
What we offer:
- Our CE Readiness Workshop to home in on your control gaps.
- Technical support and expert advisory tailored to Cyber Essentials
- Dedicated consultant support throughout your submission process
Contact Evalian to speak with our team of experienced security consultants who have successfully helped hundreds of businesses become CE certified.
