1. Goodbye to Passwords

2. Identity and Access Management
Security Discipline enabling:
Right Individuals access to the
Right Resources at the
Right Times for the
Right Reasons
On an enterprise level, IAM addresses need to ensure appropriate access to resources across increasingly heterogeneous technology environments, and to meet rigorous compliance requirements

3. Problems with passwords
Too many, too long
Users don’t remember them
Users lack faith in passwords
Infrastructure to manage passwords
Telesign Consumer Account Security Report – June 2015)
N = 2,020; US & UK
“Only 30% of users are confident that their passwords will protect the security of their online accounts.”(Telesign Consumer Account Security Report – June 2015)

4. Security Risks Weak passwords, lack of policies
Top10 Corporate Environment Passwords
Weak passwords, lack of policies
Using the same passwords on multiple accounts – Domino Effect
Frequency of password changes
Password sharing
Shoulder surfing
Password storage
Network World.com –Aug 2014
“You don't need mad hacking skills to crack Password1, Hello123 and password – 86% of hackers surveyed at Black Hat said they weren't worried about being busted at any rate.” (Network World.com – Aug 2014)

5. Authentication Methods
ID & password authentication
Biometric authentication devices & system
Enterprise single sign-on (SSO)
Public Key Infrastructure (PKI) and digital certificate
Security Token and smart card
2FA & Multi-factor authentication
Knowledge, possession, inherent, location and time.
SecSign Technologies – Nov 2014; 2FA: two factor authentication
“With the approach used by Google, Apple, and Microsoft, two-step verification combines the first two of these factors—something known only by the user, which is the account password, and something that only the user possesses, such as the smartphone or land line telephone.” (SecSign Technologies – Nov 2014)

6. Biometric Authentication

7. The future Fast Identity Online (FIDO) Alliance FIDO Members
non-profit founded in July 2012 and publicly announced in February 2013
FIDO Members
Google, Samsung, Microsoft, Bank of America, Amex, MasterCard, Visa, etc.
FIDO Protocol Standards
“The FIDO method is more secure than current methods because no password of identifying information is sent out; instead, it is processed by software on the end user's device that calculates cryptographic strings to be sent to a login server.” (TechTarget.com – May 2014)

8. Questions/Comments

9. References: