December 4, 2019

Setting the Standards: Your Guide to FIDO2 and WebAuthn

Passwords are behind the vast majority of data breaches. FIDO2 and its core component WebAuthn can change all that. Learn more here.

Over 80% of corporate data breaches occur as a direct result of poor password practices.

Today, even two-step authentication isn't enough because in most cases, if someone has your password, they have everything else they need to get into your accounts.

This is why using continuous authentication is essential to protecting your data and company. Keep reading to learn more about FIDO2 and the standards it sets for data security.

What is FIDO?

FIDO stands for fast ID online. The term along with a set of standards was created by the FIDO Alliance, an organization determined to improve web security through standardization and by offering certification to companies that meet standards.

Because technology is always changing, web security is an ever-evolving industry. For that reason, FIDO recently updated their security standards. This update is known as FIDO2.

FIDO2 Standards

Let's jump right into a few of the standards that have been established by FIDO2. WebAuthn is the software program that puts these into practice and can be added to nearly any web browser.

Local Password Storage

One of the ways many cybercriminals get ahold of passwords is because of where they're stored. When you allow your browser to save a password, do you know where it ends up?

In many cases, it ends up on a separate server which can make it vulnerable to attacks. FIDO2 standards demand that a password is saved on a device rather than an external server.

The password is not allowed to leave that device for any reason which prevents it from being stolen remotely. An individual would have to have possession of your device to log into your account.

Unique Passwords

Another common way cybercriminals gain access to business accounts is because people use the same password for all of their accounts, both personal and professional.

Since many home computers are less secure than corporate ones, it's easy for an attacker to get someone's social media password and successfully use it with their business login as well.

FIDO2 prohibits the use of the same password more than once, so every website and every account has a unique password which makes it impossible for a hacker to get into multiple accounts with the same credentials.

Biometrics

As we mentioned before, passwords alone are not secure, even if the above standards are being met. That's why FIDO2 demands that devices take security a step further and use biometrics to confirm account ownership.

With this, there's no need to run out and get a USB fingerprint scanner for every computer in the office. FIDO2 recommends using existing built-in tools for this, including computer web cameras and smartphone fingerprint scanners.

Let Us Help You Secure Your Data

Now you know what FIDO2 is and how these standards can help you secure data through web authentication. As you can see, putting these standards into practice will protect data by adding lines of defense behind your passwords.

If you want to find a company that offers this level of security, look no further than Acceptto. We are proud to be FIDO-certified and have our own FIDO server to protect our clients.

Contact us today for more information about how we can ensure your company's cybersecurity meets the highest industry standards.

FIDO2 WebAuthN