With more employees working remotely, organizations must adjust their approach to cybersecurity. Rather than monitoring a single physical perimeter, they now have to protect an expanding list of resources as employees access systems and infrastructure over the cloud. 

This access shift has changed how companies look at protecting their resources, and security-minded businesses are moving to a zero trust framework that focuses on both authentication and access control. 

Zero trust authentication protects resources by ensuring all people, devices, and software have proven identity and access rights by providing specific information. Once that validation is received, access is granted only to areas needed for the specific tasks being performed. 

Passwords, once the standard for identity authentication, are no longer the best choice (and perhaps never were). Zero trust recognizes that passwords, even with multi-factor authentication (MFA), are insecure, expensive, error prone, and interrupt an employee’s workflow. Instead, zero trust requires using excellence in authentication—a process that is both secure and accepted by users that utilizes accurate, data-rich, continuous risk-based authentication. 

Zero trust is not a specific technology or a single strategy. A true zero trust framework combines multiple tools and strategies. Here are the five requirements you need to implement zero trust authentication:

1. Strong validation of users 

If an unauthorized user gains access to your system, your cybersecurity efforts are then limited to reducing further risk and preventing access to additional resources. The key is preventing attacker access in the first place. 

Passwords are easily obtained through phishing or purchased on the dark web. While many organizations turn to password managers and MFA to improve password security, both technologies can be intercepted or breached. Zero trust requires strong validation of users through phishing-resistant, passwordless MFA. 

Beyond Identity replaces passwords with asymmetric cryptography that employs public/private key pairs, thus creating a phishing-resistant authentication process. Users are authenticated by proving they possess the enrolled device and that the device is bound to the user’s identity. Because passwords are not used at all during the process, the risk of stolen credentials or users falling victim to phishing schemes is eliminated. 

2. Strong device validation 

With strong device validation, organizations limit unauthorized “bring your own device” (BYOD) and grant access only to known devices. During the validation process, the network verifies that the device is bound to the user and then determines that the authorized user currently possesses the device. The device itself is also verified for security and compliance, ensuring it meets the set security policies (such as using a device management system). 

Because Beyond Identity installs the authenticator on enrolled devices, the authenticator ensures device security and compliance (i.e., verifying the phone isn’t jailbroken and has updated software versions installed). When you use Beyond Identity, the policy engine compares the data against your risk-based security policies and makes an access decision based on the results. Beyond Identity performs this level of authentications each time the user authenticates. 

3. Low-friction authentication for users and administrators

Asking your users to follow safe password practices is a misnomer. Not only are passwords unsafe by their very nature, the extra steps organizations add trying to ensure “safe” practices cause friction. That friction leads to employee complaints, especially regarding the extra steps, second device requirements, and increased time needed to log in using MFA. 

This means many organizations only use MFA in the specific cases required to meet compliance requirements. Passwords and MFA also create additional time-consuming tasks for administrators, which take valuable time away from other projects. Advanced authentication utilizes processes and technology easy for employees to adopt and easily managed by IT staff. 

To authenticate with Beyond Identity, users are verified via the biometric scanner on their device. Because users do not enter a password, use a second device, or type a code, they are not annoyed by or resistant to the process. And it only takes seconds to log in. Your users can also enroll their own devices using the self-service portal, which further reduces friction for them as well as administrators and support staff. 

4. Integrations with IT management and security tools 

When deciding what access to grant, you should collect as much information about your users, devices, and transactions as you can. For users, look at their identity, role, and permissions by analyzing data from single-sign-on tools, identity management platforms, and privileged access management tools. 

You can collect data on device security postures through authentication solutions, endpoint detection and response tools, and mobile device management systems. Transaction data, such as login and transaction requests and geolocation, can be collected from authentication solutions and network/cloud management systems. 

When implementing your zero trust policy engine, your organization can utilize the data to make accurate risk-based decisions. However, this requires integrations to data sources and tools to properly communicate decisions, send alerts to the SOC, and send log data.

It’s essential to provide trustworthy data to auditing systems and governance applications. Beyond Identity offers out-of-the-box, API-based integrations with leading products to meet all of these needs.

5. Advanced policy engines 

Policy engines apply security policies to control access to information assets. By using a policy engine with an easy-to-use interface, security teams can define policies such as risk level and risk scores that control access. Automated policy engines help collect data from tens of thousands of devices, including multiple devices for both employees and contractors. 

Because leveraging risk scores instead of raw data makes sense in many situations, the engine must also access data from a range of IT management and security controls. After collection, the policy engine evaluates the data and takes the action defined by the policies, such as approving the access request, blocking the access request, or quarantining a suspicious device. 

The engine must also continue to evaluate the risk of granting access and take actions such as removing access for devices that have been inactive for a set period of time. 

Beyond Identity administrators can easily set up security policies for most use cases. These policies continually assess the factors you specify with your policy engines to make risk-based authentication decisions for every transaction, not just for initial logins. Administrators can then automate actions based on risk assessments, such as approving requests and sending alerts. 

Designing an authentication process that is both phishing resistant and passwordless is a key component of a zero trust framework. By partnering with Beyond Identity, your enterprise has a powerful tool that reduces risk and improves the user experience. 

To learn more about zero trust frameworks, download Beyond Identity’s white paper, “The Rise of Zero Trust Authentication.”