[MUSIC]
Libby Brown: Hi, my name’s Libby Brown. I'm a Senior
Program Manager within Microsoft Identity. I'm here to talk
to you today about why to go passwordless. Microsoft is on
a journey to help our users get rid of passwords. Why do we
want to get rid of passwords? One, users hate them. They're
hard to remember. They're hard to get right. They get reused
everywhere. It’s not easy to use a password manager. And IT
admins hate them for those same exact reasons. They get
reused everywhere, users forget them all the time, it costs
a lot to have them reset. You know who loves passwords?
Hackers. A 2017 Verizon study showed that 81% of data
breaches were the result of weak, default, or stolen passwords.
The hackers out there have the lists of most commonly used
passwords and they are trying them against your accounts
every day.
So, we know that multi-factor authentication or MFA is a great
way to reduce the impact of those bad passwords. We see from
Microsoft’s standpoint that 99% of common password attacks
are forwarded if an account has MFA enabled. Unfortunately,
we know that there’s also some challenges around getting
end users to use them. It’s a complicated extra step.
Unfortunately, they're also still susceptible to more attacks
such as man in the middle and phishing. So, with that, we know
that passwords are terrible and low security. We know that
multi-factor authentication traditional methods, such as an
OTP code or an SMS code are less than convenient, although
they do provide higher security. We at Microsoft want to get
to that holy grail, that better way of both convenience and
high security. So, we are working to bring three different
passwordless methods for you to give to your organization,
so that your users can keep their identity safe, your users
have better usable experience, and more choices to go
passwordless. I'm going to talk about each of these three
methods, Windows Hello for business, passwordless with
Microsoft Authenticator and FIDO2 security keys.
Windows Hello is our premiere passwordless experience. It’s
been on the market since 2016. Through Windows Hello, an
end user can use either a simple pin or a biometric gesture
such as a facial recognition or a fingerprint scan and they're
instantly logged on to their computer. It’s fast, simple, and
seamless. The next option is going passwordless with a
Microsoft Authenticator app. This is an experience where
your users who have already registered the authenticator
with MFA push notifications, can simply upgrade their
account in the app and have a full passwordless experience.
You can find out more information at aka.ms/gopasswordless
and I will be doing a demo in a later video.
Our last passwordless method are FIDO2 security keys. FIDO
stands for fast identity online and the FIDO alliance has created
this standards based passwordless authentication method using
two common protocols known as WebAuthN and CTAP or
client to authenticator protocol. Microsoft will be launching
FIDO2 security keys with the computers running the Windows 10
March update as well as the Edge and Firefox browsers.
We’re excited about using FIDO2 security keys to allow our
customers to go passwordless because of these open standards.
These standards allow a broad range of customer scenarios and
we’re proud to partner with several key industry vendors
including Fatein Technologies, HID Global, and Ubico to
launch with a various selection of keys right at the start. FIDO2
security keys are most commonly in a USB or NFC format,
they will be coming with biometrics to allow your user to
simply tap the key and login and we’ve even seen coming some
biometric wearables, so imagine a future where you can take
your ring, tap it to your computer, and login passwordlessly.
Now one of the reasons we’re so excited about passwordless
technologies is there are all an extraordinarily secure
authentication flow. And all of these methods are based on a
very simple common architecture. We use a public private-key
encryption such that for each of these devices, be it the
Windows Hello machine, the Microsoft Authenticator app, or
your FIDO2 security key, we create a public private-key
pairing. That private-key is stored only on that device. It is
protected by a local gesture, whether that’s a biometric or a
pin that is bound only to that device. The public-key gets
registered in the Azure AD cloud. So, when a user goes to
authenticate using one of these passwordless methods, they
will perform the gesture to login, the cloud sends a signal
to the device, the device signs a nonce with that private-key
and use the biometric to do that signing, Azure AD takes that
signed key, matches it with the public-key and authenticates.
Never are those credentials shared or do they leave the device.
Now we recognize that this is an amazing undertaking of the
entire journey of technology, especially around FIDO2 security
keys. So, we talk about going passwordless you need to start
with a plan for your journey. The very first step is enabling
Azure Active Directory. Next the pre-requisites to go
passwordless are to allow Azure multi-factor authentication for
your users because that is how you create those strong security
keys. We also recommend enabling self-service password reset
because we have found that the less people use their passwords,
the more they forget them. In order to take advantage of these
passwordless authentication methods, you need to think
about which apps are going to be using the passwordless
authentication protocols and the Microsoft authentication
libraries. It’s a good time to take an inventory of the apps that
your users most commonly use and consider how you're going
to update them to take advantage of the most modern
authentication protocols. You also need to think about the
hardware that your users are going to use. Will they be capable
of using these new modern credentials? Can your PC’s use
Windows Hello for business? Will they be able to use the FIDO
protocols? These are things that you want to think about as
you're planning your next hardware upgrades and your
management story around those devices.
And lastly, we’d love for you to start with a pilot. If this
seems like a daunting journey, start small. Think about, is
there a group of users that you might be able to start by
deploying Windows Hello? Maybe they need a new hardware
refresh and now is a good time to get them on that wonderful
user experience. Next, perhaps using the Microsoft Authenticator
passwordless phone sign-in works for those users who are
very mobile and are already using the Microsoft Authenticator
app for Azure MFA verification. Another option is thinking about
who in your organization might benefit from strong
authentication methods but can’t take advantage of either a
Windows Hello capable PC or use their personal device for
Microsoft Authenticator. FIDO2 security keys are perfect for
those mobile or kiosk workers who still need a strong
authentication into their corporate resources.
On screen you’ll see some resources about how to learn more
about going passwordless. Thank you. That concludes our
session on Microsoft’s methods for going passwordless. Stay
tuned for the next video where we’re going to show you how
to manage and use these credentials. [MUSIC]