'Old-fashioned' authentication still the norm

In light of recent phishing-based cyberattacks and in recognition of Cybersecurity Awareness Month, Yubico, the leading provider of hardware authentication security keys, has shared the results of its inaugural State of Global Enterprise Authentication Survey 2022 at a security thought-leadership industry summit hosted by the company in its San Francisco office. The survey, conducted for Yubico by Censuswide, polled 16,000+ employees across a variety of enterprises in eight countries* and asked about their perceptions and perceived challenges of multi-factor authentication (MFA), security tools and internal security practices at their organisation, and their recent experiences with cyberattacks. 

While the survey revealed numerous interesting data points, these telling cybersecurity authentication and MFA trends surfaced to the top: 

• 59 per cent of employees still rely on username and password as their primary method to authenticate into accounts

• Nearly 54 per cent of employees admit to writing down or sharing a password

• Over 22 per cent of those surveyed still think username and password is the most secure method of authentication

• 61 per cent of employees think their organisation needs to upgrade to modern phishing-resistant MFA and 79 per cent of VP-level staff want their organisation to upgrade to modern phishing-resistant MFA (like hardware security keys) 

• More than 54 per cent of employees are not required to go through cybersecurity training on a frequent basis

• Over the last 12 months, nearly 57 per cent admit to using a work-issued device for personal use

• Within the last two years, nearly 40 per cent of survey respondents admits to having broken their mobile phone and nearly 30 per cent have lost it (a device organisations commonly use to authenticate) 

“Cybersecurity Awareness Month brings global awareness for security hygiene and is a good time for people and organisations to take action now to shore up their cybersecurity practices,” said Stina Ehrensvärd, CEO and co-founder, Yubico. “The results from Yubico’s global survey highlight the biggest concerns, challenges, and real-world scenarios that organisations are facing globally when it comes to their cybersecurity efforts – including the continued reliance on legacy MFA solutions like one-time passwords. It’s a stark reminder of how far the enterprise still has to go to adopting and standardising phishing-resistant MFA tools.”

The State of Authentication

To further foster conversations around the importance of modern authentication, Yubico brought together cybersecurity industry leaders for its inaugural YubiSummit event in San Francisco, which included leading organisations at the forefront of security, influencers, and media for in-depth discussions around the top challenges facing enterprises today. In addition to Yubico executives CEO and co-founder Stina Ehrensvärd, CIO and co-founder Jakob Ehrensvärd, CISO Chad Thunberg, and vice president Derek Hanson, attendees included Brave, Union Pacific Railroad, Defending Digital Campaigns, Microsoft, Google, and Rachel Tobac, ethical hacker and CEO of SocialProof Security.

Some of the topics discussed at the YubiSumit included:

• Move over passwords: passkeys are the new kid in town. After the findings of the survey were unveiled, Yubico’s Hanson shared information on demystifying the new term of passkeys including what they are, specific use cases and benefits, and what enterprises should consider between the use of passkeys and security keys.

“Seeing the results of the survey and then contrasting that data with what we’re hearing is happening to companies, it only re-emphasises what we already know – that passwords are not enough and that not all MFA is created equal,” said Hanson. “We’re excited about the arrival of passkeys to help make FIDO authentication globally accessible. It is important to understand how passkeys will impact your organisation and what type of passkey is right for you. Passkeys, by definition, are passwordless-enabled FIDO credentials, but YubiKeys only create hardware-bound passkeys which are not copyable – ensuring the highest level of security for enterprises.”

• What the hack: advice from an ethical hacker. Tobac debuted a video with Yubico, demonstrating how cyber criminals hack by tricking people. The video highlights an attack vector seen frequently in recent news stories in which an employee is tricked into going to a malicious link, putting in their username and password and handing their 2FA codes to the attacker – all within a few seconds. She discussed the evolution of cyberattacks and the importance of deploying modern MFA, like a YubiKey, to stop attackers in their tracks during a hack. 

“If your threat model is elevated because you have admin access at work, are in the public eye, or being targeted/harassed, it's essential to consider FIDO security keys to prevent the most common attacks we're seeing in the news right now,” said Tobac. 

• Our corporate responsibility: protecting those at risk around the world. Mary Mangione, Yubico’s senior communications and brand manager and lead for its philanthropic programme, Secure it Forward, was joined by experts from Google, Microsoft, and Defending Digital Campaigns to discuss protecting high risk users across journalism, civil society, and politics. The conversation focused on the importance of companies partnering to leverage joint resources to keep these vulnerable populations secure. 

“Collaborating with organisations like Google, Microsoft, and Defending Digital Campaigns allows us to better protect high risk users and organisations that need it most,'' said Mangione. “At Yubico, our Secure it Forward programme provides YubiKeys on a global scale at no-cost to help equip journalists, political organisations, and non-profits with strong security.”