Multi-factor authentications soar as enterprises move away from passwords to secure hybrid workers

Enterprises are taking steps to move away from passwords and adopting low-friction authentication methods to protect the hybrid workforce, a Cisco’s Duo Security report reveals.

Multi-factor authentications increased significantly

While the total number of multi-factor authentications increased 39% in the past year, biometric authentications grew even faster at 48%.

The report analyzed data from more than 36 million devices, over 400 thousand unique applications and roughly 800 million monthly authentications. It revealed how organizations across all industries are enabling work from anywhere, on any device, by implementing controls to ensure secure access to applications.

Biometrics were enabled on more than 71% of mobile phones, illustrating a rise in adoption driven by users’ growing acceptance of non-traditional authentication methods and the accessibility of passwordless hardware that they already carry in their pockets.

Further eliminating the need for users to retain a large cache of authentication passwords, there was also a fivefold increase in Web Authentication (WebAuthn) usage since April 2019 when the World Wide Web Consortium (W3C) first published the open standard. WebAuthn enables biometrics to be securely stored and validated locally on the device, as opposed to a centralized database.

Organizations moving toward a passwordless strategy

Moving away from passwords will significantly improve the login experience for the vast majority of users – in turn leading to stronger security. More than half of organizations are planning to implement a passwordless strategy, according to a new survey of global IT decision makers. Forty-six percent of respondents said security issues related to compromised credentials are the most frustrating or concerning aspect of dealing with passwords in their environment.

“We’ve now reached the point where the user experience is a security control in and of itself,” said Dave Lewis, Global Advisory CISO at Cisco.

“Enterprises are moving toward new, more effective ways of handling access control and seeing in action how democratizing security can go a long way in enabling hybrid workers to focus on their core competencies without sacrificing security.”

Setting stricter policies to verify identity

The importance of user-centric security that incorporates employee work patterns to keep resources accessible and out of reach for malicious actors is reinforced by the recent Cisco Hybrid Work Index. The report showed that while there was a surge in VPN and secure remote access at the onset of the pandemic, fraudulent access attempts grew 2.4 times during the same time period and remains elevated 18 months later.

Due to these threats, organizations are setting stricter policies to verify the trust of users and devices before granting access to applications. The number of authentication failures due to out-of-date devices increased 33% between 2020 and 2021.