Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / Passkeys are a trap. Do not use them

Transcript

Passkeys are a trap. Do not use them · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:14
  Host: Today we’re diving into the wave of enthusiasm around passkeys and why that enthusiasm might be a trap for regulated organizations.
• 0:22
  Analyst: Passkeys promise a password-less experience that feels frictionless, but the reality is that they rely on device-bound credentials that can be exploited by sophisticated adversaries.
• 0:34
  Host: Can you walk us through how a passkey actually works, from the moment a user registers to the instant they authenticate?
• 0:40
  Analyst: When a user registers a passkey, a cryptographic key pair is generated locally on the device. The public key is stored on the service provider, while the private key remains encrypted on the device.
• 0:52
  Analyst: Authentication occurs when the device signs a challenge from the service, and the provider verifies the signature using the stored public key.
• 1:01
  Host: So because no secret travels over the network, passkeys avoid phishing and credential stuffing, right?
• 1:07
  Analyst: Exactly, that’s one of the key selling points. But the security of the private key depends entirely on the integrity of the device and the strength of its local encryption.
• 1:17
  Host: If an attacker gains access to the device or its encryption keys, the passkey can be used to impersonate the user without any other verification.
• 1:25
  Analyst: That’s why device-centric risks are a major factor to consider. Regulated organizations often deploy a mix of corporate laptops, personal mobile phones, and government-issued hardware.
• 1:38
  Analyst: Each device type presents distinct risk factors: corporate laptops may be managed by an endpoint management system, but they can still be compromised through supply-chain attacks or malware that exfiltrates encryption keys.
• 1:52
  Analyst: Personal mobile phones are typically outside the scope of enterprise controls, increasing the likelihood of insecure storage or loss.
• 2:00
  Analyst: Government-issued hardware may have hardened security, yet the proliferation of edge devices introduces new attack surfaces.
• 2:08
  Host: So if the passkey lives on a compromised device, the entire chain collapses.
• 2:13
  Analyst: Exactly, and that’s why the assumption that passkeys eliminate the need for MFA is misplaced.
• 2:19
  Host: Traditional MFA solutions, like TOTPs or hardware tokens, add an independent layer that can still be verified even if the first credential is compromised.
• 2:27
  Analyst: Passkeys, on the other hand, provide a single point of trust: the device. If that device is compromised, the whole authentication chain collapses.
• 2:37
  Host: Zero-trust authentication treats every request as potentially hostile, continuously verifying user, device, and context before granting access.
• 2:46
  Analyst: That continuous verification includes device posture checks that confirm the device meets security baselines, contextual analysis of origin, time, and location, and behavioral analytics that spot anomalies.
• 3:01
  Host: So even if a passkey is used, the zero-trust model still layers additional checks.
• 3:06
  Analyst: Layered MFA integration means that when a passkey is deployed, you can still require a biometric prompt or a hardware token as a second independent verification step.
• 3:17
  Host: Adaptive authentication also comes into play, adjusting the verification requirements based on risk.
• 3:23
  Analyst: For example, a login from an unfamiliar device or an unusual location might trigger a secondary factor, while a routine access from a known corporate laptop could pass with just the passkey.
• 3:36
  Host: That dynamic approach sounds like a good balance between user experience and security.
• 3:41
  Analyst: It also aligns with the continuous monitoring requirement that many compliance frameworks mandate.
• 3:47
  Host: Speaking of compliance, how do passkeys fit into frameworks like NIST SP 800-171 or PCI DSS 4.0?
• 3:55
  Analyst: NIST SP 800-171 requires multifactor authentication for remote access to controlled unclassified information and continuous monitoring of authentication events to detect anomalies.
• 4:10
  Analyst: Passkeys technically qualify as a multifactor credential, but they don’t inherently provide the continuous monitoring or contextual risk assessment that the standard expects.
• 4:21
  Analyst: Without adding device posture checks or behavioral analytics, a passkey-only approach could fall short of the intent of NIST SP 800-171.
• 4:32
  Analyst: CMMC emphasizes strong identity and access management practices, especially at higher maturity levels where continuous monitoring and adaptive authentication are required.
• 4:44
  Analyst: If a passkey implementation lacks device posture checks or behavioral analytics, it may not satisfy the higher maturity levels of CMMC.
• 4:53
  Host: What about HIPAA? Patient data is a high-stakes environment.
• 4:57
  Analyst: HIPAA’s Security Rule requires multifactor authentication for electronic protected health information. A passkey that allows single-factor access from an unmanaged device could expose ePHI to unauthorized parties, violating the rule.
• 5:13
  Host: PCI DSS 4.0 also has a strong stance on authentication.
• 5:18
  Analyst: While passkeys can be considered a strong credential, the standard requires that authentication methods be regularly tested and that risk-based authentication be employed.
• 5:29
  Analyst: A passkey implementation that does not incorporate risk scoring may not meet PCI DSS expectations.
• 5:36
  Host: So the core issue is that passkeys alone don’t provide the continuous, contextual, and layered verification that these frameworks demand.
• 5:44
  Analyst: Zero-trust authentication, by contrast, treats every request as potentially hostile and continuously verifies user, device, and environment before granting access.
• 5:56
  Host: What does that look like in practice for a regulated organization?
• 6:00
  Analyst: First, you start with device posture checks that confirm the device meets security baselines. That includes patch status, encryption status, and endpoint protection.
• 6:10
  Analyst: Second, you apply contextual analysis of the request origin, time, and location. If a login comes from a new country or an unusual time, the system can flag it for review.
• 6:22
  Analyst: Third, you integrate behavioral analytics that learn typical user activity patterns and detect anomalies.
• 6:29
  Host: How do you combine passkeys with other factors in a zero-trust architecture?
• 6:33
  Analyst: You treat the passkey as one factor, and then you enforce a second factor that is independent, such as a biometric prompt or a hardware token, especially for high-risk systems.
• 6:44
  Host: What about organizations that must satisfy NIST SP 800-171 or CMMC? Do they need to layer passkeys with something else?
• 6:53
  Analyst: Yes, the zero-trust model requires continuous monitoring and risk-based authentication, so a passkey alone is not enough. You must add device posture checks, contextual risk scoring, and behavioral analytics.
• 7:07
  Host: So the takeaway is that passkeys are not a silver bullet.
• 7:10
  Analyst: They are a valuable component of a broader, zero-trust authentication strategy when deployed with rigorous device management, continuous monitoring, and layered multifactor controls.
• 7:22
  Host: Given that, what does a regulated organization need to do to ensure passkeys don’t become a compliance risk?
• 7:29
  Analyst: First, conduct a comprehensive inventory of all authentication methods in use, including passkeys, passwords, and MFA solutions.
• 7:38
  Analyst: Second, map the specific authentication controls required by applicable frameworks such as NIST SP 800-171, CMMC, HIPAA, and PCI DSS.
• 7:51
  Analyst: Third, evaluate the passkey implementation risks by reviewing device management policies, encryption strength, and the potential for device compromise.
• 8:01
  Host: That makes sense. What about the zero-trust controls that need to be deployed?
• 8:05
  Analyst: You need continuous device posture checks, contextual risk scoring, and behavioral analytics. These should be integrated with your security information and event management pipeline.
• 8:17
  Host: And how do we layer MFA with passkeys in this architecture?
• 8:20
  Analyst: Layer additional factors such as biometric prompts or hardware tokens as a second independent verification step, especially for high-risk systems or when accessing sensitive data.
• 8:32
  Host: What about monitoring and incident response? How does that fit into the zero-trust model?
• 8:38
  Analyst: Integrate passkey authentication events into your SIEM so you can correlate them with other authentication events. Define response playbooks for anomalies such as logins from new locations or devices.
• 8:51
  Host: That sounds like a lot of work. Do you have any ready-made solutions?
• 8:55
  Analyst: Petronella Technology Group offers managed XDR services that provide real-time detection and automated response to authentication anomalies across your environment.
• 9:07
  Analyst: Their virtual CISO services give strategic oversight of your identity and access management program, ensuring alignment with industry best practices.
• 9:17
  Host: That’s helpful. Are there any industry-specific guidance points we should keep in mind?
• 9:22
  Analyst: For defense contractors, you should ensure all passkey-enabled devices are enrolled in a strong endpoint management system and that devices meet required security baselines before allowing passkey authentication.
• 9:35
  Analyst: Apply redundancy by requiring an additional factor, such as a hardware token, when accessing high-risk systems, and implement auditability with logging that correlates passkey usage with other authentication events.
• 9:49
  Host: What about healthcare organizations?
• 9:51
  Analyst: Separate passkey usage for clinical devices from administrative devices, apply stricter authentication for remote access to patient records, and ensure passkey usage can be reported to auditors in a HIPAA-compliant format.
• 10:05
  Analyst: For legal firms, limit passkey usage to fully managed and encrypted devices and combine passkeys with biometric authentication for access to sensitive case files.
• 10:16
  Analyst: Deploy continuous monitoring with behavioral analytics to detect unusual access patterns.
• 10:22
  Host: And for financial services?
• 10:24
  Analyst: Ensure device posture checks before passkey authentication, require adaptive authentication for high-value transactions, and maintain detailed audit trails of passkey events for compliance reporting.
• 10:37
  Host: So the overarching message is that passkeys alone aren’t enough; they need to be part of a broader zero-trust strategy.
• 10:44
  Analyst: By combining passkeys with disciplined device management, continuous monitoring, and layered multifactor controls, regulated organizations can meet compliance mandates while still providing a frictionless user experience where appropriate.
• 10:59
  Host: What should an organization do next to ensure their passkey strategy is compliant?
• 11:03
  Analyst: Start by auditing your current authentication landscape, map compliance requirements, evaluate passkey implementation risks, and then deploy zero-trust controls with layered MFA.
• 11:15
  Analyst: You’ll also need to integrate passkey events into your SIEM, define incident response playbooks, and schedule regular audits to confirm device compliance and policy enforcement.
• 11:26
  Host: That’s a solid framework. Thank you for breaking it down.
• 11:30
  Analyst: Glad to help. Remember, the key is to treat passkeys as one factor in a layered, zero-trust architecture that meets your compliance obligations.
• 11:39
  Host: Great, we’ll keep that in mind.
• 11:42
  Analyst: If you need help implementing these strategies, feel free to reach out to Petronella Technology Group for a tailored assessment.
• 11:49
  Host: Thanks for that reminder.
• 11:50
  Analyst: Happy to help. Have a secure day.
• 11:52
  Host: Let’s dig a bit deeper into why passkeys alone can create blind spots in a regulated environment.
• 11:57
  Analyst: The core issue is that passkeys tie authentication to a single device. If that device is compromised, the attacker gains a foothold that bypasses other controls.
• 12:08
  Host: So even though the cryptography is strong, the device becomes the single point of failure.
• 12:12
  Analyst: Exactly. And in many organizations, devices are a mix of corporate laptops, personal phones, and specialized hardware, each with its own risk profile.
• 12:23
  Host: Right. Now, what practical steps can an IT leader take to mitigate those risks?
• 12:28
  Analyst: First, inventory every device that can store a passkey. Then apply a strict endpoint management policy that enforces OS updates, encryption, and anti-malware.
• 12:39
  Host: That sounds like a foundational requirement. What about personal devices that employees might use?
• 12:45
  Analyst: For personal devices, consider a bring-your-own-device policy that requires the device to meet a minimum security baseline before you allow passkey registration.
• 12:56
  Host: Can you give an example of a baseline?
• 12:58
  Analyst: Sure. It might include a supported OS version, up-to-date patches, full-disk encryption enabled, and a reputable endpoint protection suite running.
• 13:08
  Host: Once the devices are vetted, how do we incorporate passkeys into a zero-trust model?
• 13:13
  Analyst: You layer passkeys with another independent factor. For instance, a biometric prompt or a hardware token that the user must present at each login.
• 13:22
  Host: So passkeys become the first factor, and the biometric or token is the second?
• 13:27
  Analyst: Yes, that gives you the multi-factor assurance that compliance standards demand.
• 13:32
  Host: You mentioned continuous monitoring earlier. How does that work with passkeys?
• 13:37
  Analyst: You feed every authentication event into your SIEM, tagging the event with device posture, location, time, and any behavioral signals.
• 13:47
  Host: And then you look for anomalies, like a login from a new country?
• 13:50
  Analyst: Exactly. You can set thresholds that trigger a secondary factor if the risk score exceeds a certain level.
• 13:57
  Host: What about auditability? Regulators often require detailed logs.
• 14:01
  Analyst: Make sure your passkey authentication flow writes to a central log that includes the device identifier, the public key used, and the authentication time.
• 14:11
  Host: That satisfies the continuous monitoring requirement of NIST SP 800-171, right?
• 14:17
  Analyst: It does, provided you also have a process to review those logs for anomalies on a regular basis.
• 14:23
  Host: What are common mistakes organizations make when adopting passkeys?
• 14:27
  Analyst: A big one is assuming that because passkeys are phishing resistant, you can remove all other factors.
• 14:33
  Host: So you’re still bound to keep MFA?
• 14:35
  Analyst: Yes. Another mistake is ignoring device management. If a device is lost or stolen, the passkey can still be used unless you have remote wipe or deprovisioning.
• 14:46
  Host: That would be a huge compliance gap.
• 14:48
  Analyst: Indeed. Lastly, some organizations fail to integrate passkey events into their incident response playbooks.
• 14:55
  Host: Meaning they don’t have a defined response if a passkey is compromised?
• 14:59
  Analyst: Correct. You need to treat passkey misuse the same way you treat any credential compromise.
• 15:04
  Host: Let’s talk about the specific compliance frameworks. How does passkey usage align with PCI DSS 4.0?
• 15:12
  Analyst: PCI DSS 4.0 requires strong authentication and risk-based controls. Passkeys can meet the strength requirement, but you must also implement continuous risk assessment and adaptive authentication.
• 15:26
  Host: So you can’t just rely on passkeys for cardholder data access?
• 15:29
  Analyst: Exactly. You need to combine them with other controls, like transaction limits and monitoring.
• 15:35
  Host: What about HIPAA?
• 15:36
  Analyst: HIPAA’s Security Rule mandates multifactor authentication for ePHI. Passkeys alone, especially on unmanaged devices, would fall short unless you add another factor and enforce device posture.
• 15:50
  Host: And NIST SP 800-171?
• 15:53
  Analyst: The standard requires multifactor authentication for remote access to controlled unclassified information. It also calls for continuous monitoring of authentication events, which passkeys alone don’t provide.
• 16:07
  Host: So the zero-trust approach satisfies all of those?
• 16:10
  Analyst: Yes, because it continuously verifies the user, device, and context, and adapts authentication based on risk.
• 16:18
  Host: Can you outline a quick implementation checklist?
• 16:21
  Analyst: First, inventory and classify devices. Second, apply endpoint security baselines. Third, enable passkey registration only on compliant devices. Fourth, add a second factor for high-value actions. Fifth, log all authentication events to SIEM. Sixth, set up risk scoring and adaptive triggers. Seventh, review logs regularly and adjust thresholds.
• 16:47
  Host: We need to be careful not to use numbers not in the article, right?
• 16:50
  Analyst: Yes, we’re sticking to the terms from the source. You can just phrase it as a series of steps.
• 16:55
  Host: What about user education? Do employees need to know something special?
• 17:00
  Analyst: They should understand that passkeys are device-bound and that losing the device or having it compromised is a credential breach. They need to report lost devices immediately.
• 17:10
  Host: Do you see any industry-specific nuances?
• 17:13
  Analyst: Defense contractors often use government-issued hardware, so you should verify that the hardware complies with the required security baseline before allowing passkey usage.
• 17:24
  Host: Healthcare providers?
• 17:25
  Analyst: They should separate passkeys used for clinical devices from those used for administrative access, and enforce stricter checks for remote patient record access.
• 17:35
  Host: Legal firms?
• 17:36
  Analyst: Limit passkey usage to fully managed devices and add biometric confirmation for accessing privileged case files.
• 17:44
  Host: Financial services?
• 17:46
  Analyst: Implement device posture checks and require an extra factor for transactions above a threshold or when accessed from a new location.
• 17:54
  Host: You mentioned behavioral analytics earlier. What does that entail?
• 17:58
  Analyst: It involves monitoring patterns like typical login times, locations, and device types, then flagging deviations that could signal compromise.
• 18:08
  Host: So if someone logs in from a new country, you might ask for a second factor?
• 18:12
  Analyst: Exactly. That’s adaptive authentication in action.
• 18:15
  Host: Do people often ask if passkeys can replace all other MFA methods?
• 18:19
  Analyst: Yes, and the answer is no. Passkeys can be one factor, but you should not rely on them exclusively.
• 18:26
  Host: What about the question of device loss?
• 18:28
  Analyst: If a passkey device is lost, you need a deprovisioning process that revokes the passkey and forces re-registration from a secure device.
• 18:37
  Host: And audit questions?
• 18:38
  Analyst: Auditors will want to see evidence that passkey usage is logged, that device compliance is enforced, and that you have a response plan for passkey compromise.
• 18:48
  Host: How do you ensure that your logging meets the audit requirements?
• 18:51
  Analyst: By capturing the device ID, the public key, the authentication timestamp, and any risk score associated with the event.
• 18:59
  Host: Do you have any final advice for listeners who are just starting to think about passkeys?
• 19:03
  Analyst: Treat passkeys as a tool, not a silver bullet. Build a zero-trust framework around them, enforce device security, layer multiple factors, and continuously monitor and adapt.
• 19:16
  Host: Quick question: if we already have a hardware token solution, can we just pair it with passkeys?
• 19:22
  Analyst: Yes, you can configure the token as the second factor for any passkey authentication, ensuring the token is validated before granting access.
• 19:31
  Host: And what about integration with existing identity providers?
• 19:34
  Analyst: Most modern identity providers support WebAuthn and can handle passkey registration, but you’ll need to enable the policy that requires device compliance checks before allowing the passkey flow.
• 19:47
  Host: Thanks again for clarifying all of this.
• 19:49
  Analyst: Happy to help. Have a secure day.