Passwordless authentication and passwordless security

Item: Cisco Duo
Author: Sarabjeet Rana

It’s no secret—passwords can be a real headache, both for the people who use them and the people who manage them. Over time, we’ve created hundreds of passwords, it’s easy to lose track of them and they’re easily compromised. Fortunately, passwordless authentication is becoming a feasible reality for many businesses. Duo can help you get there.

Watch the podcast

Cybersecurity professional authenticating into the network on a mobile device using passwordless authentication

What is passwordless authentication?

Passwordless authentication is the term used to describe a group of identity verification methods that don’t rely on passwords. Biometrics, security keys, and specialized mobile applications are all considered “passwordless” or “modern” authentication methods.

Passwordless provides secure access for every enterprise use case (hybrid, cloud, on-premises and legacy apps). Duo is innovating toward a true passwordless future that balances usability with stronger authentication. Passwordless gives users a frictionless login experience, while reducing administrative burden and overall security risks for the enterprise.

How passwordless works

Passwordless authentication ideally involves less user interaction during the login process than traditional forms of authentication. It uses public key cryptography, which authenticates the user with a pair of cryptographic keys—a private key that’s a secret, and a public key that isn’t—and it comes with a lexicon of new (or relatively new) acronyms and standards like FIDO2 standard (FIDO stands for Fast IDentity Online and FIDO2 is just an umbrella term for the combination of WebAuthn and Client to Authenticator Protocol [CTAP]).

Implementing passwordless is no small task, especially when you’re dealing with large user populations, a substantial number of apps, hybrid infrastructures and complex login flows. Achieving a completely passwordless environment is a journey that involves a phased approach as technology continues to evolve and user adoption increases. Although complete elimination of passwords is still far off, reducing reliance on them is already feasible by implementing multi-factor authentication (MFA), establishing trust in devices, leveraging single sign-on (SSO) and implementing adaptive access policies.

Person in yellow sweater using a laptop and holding a phone at a desk

Why passwordless matters

Passwordless authentication isn’t just a nice-to-have—it can actually improve an organization’s security posture and reduce costs associated with password management. Passwords create higher friction for users, slow down business productivity, and are inherently a weak form of user authentication.

Costly and burdensome to manage

20-50% of all IT help desk tickets each year are for password resets (Security Boulevard)
Each year, U.S.-based enterprises allocate over $1 million to password-related support costs (Forrester)

Poor user experiences

The average enterprise uses 1,400 different cloud services (SkyHigh Networks)
The average business user must log in with as many as 190 passwords (Security Magazine)

Easily compromised

Passwords that are easily detectable or reused often are vulnerable to phishing attacks. Over 80% of hacking breaches involve brute force or the use of lost or stolen credentials. (Verizon DBIR)

Why implement passwordless?

Passwordless authentication provides a single, strong assurance of users' identities to achieve user trust. For enterprises, this means:

Better user experience

A reduction in user frustration and an increase in user productivity.

Reduced IT time and costs

A reduction of the administrative burden of password-related help desk tickets and password resets.

Stronger security posture

The elimination of threats and vulnerabilities related to passwords (phishing, stolen or weak passwords, password reuse, brute-force attacks, etc.).

Is passwordless a good choice for me?

If your business has a goal of reducing the security risk associated with passwords, the answer is almost certainly “yes.” Identity is becoming the new perimeter, and to secure it, companies must put access controls around both users and their devices—also known as the “workforce.”

To address this, many organizations are adopting a zero-trust security approach, under which trust is verified at each access attempt. The best security should be invisible and have minimal impact on the productivity of users.

Passwordless authentication is a key part of verifying user trust, in a more user-friendly, simplified and secure way. However, there are a few factors that will determine the level of effort involved in implementing passwordless. If you have a complex hybrid environment, it’s going to be more difficult to transition to passwordless.

We recommend having a few technical experts assigned specifically to your passwordless project, so that you can address any issues as they arise. When done correctly, however, a passwordless approach significantly minimizes the likelihood of a breach due to stolen credentials.

Person in a denim shirt sitting on a couch, holding a smartphone, with papers and a laptop on the table in front.

The solution: A journey to passwordless

With strong MFA, SSO, adaptive access policies and device trust capabilities, you can lay the foundation for a passwordless experience today. We recommend taking a phased approach to securing access for the workforce, with each step taking you closer to a fully passwordless future:

Identify use cases and enable strong authentication

Start your passwordless journey by reducing your reliance on passwords. Pursue passwordless for only a few use cases at a time, and lower the risk of credential theft with strong authentication.

Corresponding Duo products:

Duo MFA

MFA protects users’ credentials with a strong security layer that thwarts account takeover. Once MFA is enabled for all applications, you can require fewer password resets, getting you one step closer to a passwordless experience.

Duo MFA is available in all Duo editions.

Explore Duo Essentials Explore Duo Advantage Explore Duo Premier

Streamline authentication workflows

For Cloud apps, use single sign-on (SSO) for SAML-based applications. For on-premise services, integrate application workflows using access and authentication proxies.

Corresponding Duo products:

SSO and Duo Central

Leveraging federated logins protected with MFA is a great next step toward passwordless. Integrate Duo with an existing single-sign-on (SSO) platform, or implement its alternative SSO options for SAML based applications.

Duo SSO and Duo Central are available in all Duo editions.

Explore Duo Essentials Explore Duo Advantage Explore Duo Premier

Increase trust in authentication

Apply adaptive access policies based on the context of the user, device, location, behavior, and more, to ensure authentications can be trusted.

Corresponding Duo products:

Access Policies and Device Trust

Detect anomalous user behavior and spot risky devices with policies that provide contextual signals around each access attempt. This visibility helps you verify that users are who they say they are, and that they’re using healthy devices to access your data.

Access Policies and Device Trust are available in Duo’s Advantage and Premier editions.

Explore Duo Advantage Explore Duo Premier

Provide a passwordless experience

Enable users to log in using a single biometric authenticator (or security key) to access applications at the point of federation.

Corresponding Duo products:

WebAuthn MFA and Agnostic Integrations

Duo supports password-free open standards, such as WebAuthn, as MFA methods for SAML applications. This functionality lets organizations establish a passwordless login workflow for cloud apps, without ripping and replacing existing infrastructures.

WebAuthn and Agnostic Integrations are available in all Duo editions.

Explore Duo Essentials Explore Duo Advantage Explore Duo Premier

Optimize your passwordless toolset

The final step in the journey is integrating the technology and moving towards continuous improvement. True passwordless will eliminate reliance on passwords for any login workflow, either behind the scenes or throughout your users’ experiences.

A fully passwordless product

While federation provides a starting point, enterprise companies are filled with complex use cases, including OS login and protecting legacy applications.

There is work to be done to provide passwordless homogeneously throughout an environment and organizations will move iteratively towards a true passwordless future, tackling one use case at a time.

This is the challenge in the market today that passwordless-pioneering technology platform providers need to solve. Duo is working on support for a comprehensive ecosystem that enables passwordless across every enterprise use case.

Explore Duo's passwordless authentication solution

The combination of risk-based authentication and passwordless made 99% of our logins phishing resistant as we made the transition from having a passwordless authentication to having a passwordless-only authentication.

Read the customer story

Sarabjeet Rana

Principal Engineer, Cisco