Reinforcing FIDO: How certificates and PKIfill critical gaps in FIDO authentication

Summary

Whoshould read this? CISOs, IAM directors,authentication administrators, and identity architects in regulated orhigh-risk environments who hold responsibility for securing systems andnetworks.

Whatthey’ll learn: How hardware-based authentication,specifically using certificates, enhances the implementation of Zero Trustprinciples by bolstering security while maintaining an optimized userexperience. Certificate-based authentication involves the issuance of digitalcertificates to devices, enabling them to securely authenticate with networkresources.

Axiadis proud to be one of the 40-plus vote-endowed “Board Level” members of theFIDO Alliance. Not only is the group behind Fast Identity Online fulfilling acritical cross-industry mission but the group’s latest specification, FIDO2,has become the standard for strong user authentication. Some of the reasons areclear:

• FIDO2 is asecure-by-design identity architecture
• FIDO2 movesthe market away from its old reliance on passwords
• When usingdevice-bound credentials, FIDO2 blocks external ATO attempts by requiring thepresence of physical tokens
• FIDO2device-bound tokens and passcode combinations have 1: many uses, with theability to work across multiple web sites or accounts

This is why Gartner, Inc., a research andadvisory firm, noted in 2023’s Hype Cycle for Digital Identity that FIDO2technology was moving out of the “trough of disillusionment” and into a phaseof “early mainstream” adoption. This is also why the number of Axiad customerswho say they are “all-in on FIDO” increases every year.

But like all other cybersecuritytechnologies, FIDO2 isn’t an all-purpose silver bullet. There will continue tobe use cases and scenarios that challenge FIDO2 implementation. These willrequire IAM teams to practice “layered defense” and “defense in depth”approaches when designing their identity and access architectures. Thissolution brief lays out some of those challenges in the beginning and at theend proposes enterprise-ready authentication alternatives.

Challenge #1: Usability at enterprise scale

Just like it is for B2C internet activity,usability is also king for B2B uses, although for different reasons: poorusability in commercial usage leads to expensive service ticket backlogs andhelp desk calls that sap energy, operating costs, and motivation from a companyand its employees.

Researchers at Australia’s MacqaurieUniversity performed an extensive usability study in 2023 of FIDO2’ssuitability for enterprise environments, and uncovered several interesting datapoints:

• “In particular,an adequate handling of processes such as account recovery or enrollment, andedge cases like lost authenticator were found challenging…”
• Their reportnoted that “even fundamental processes such as registration and authenticationwere also found to pose significant challenges.”
• “Ourrespondents believe that even though their general knowledge of FIDO2 issatisfactory, the practical knowledge and integration paths are still missingand pose a major obstacle.”
• “Solutioncosts and missing native integrations were spotted as a major adaptationblockers. In particular, integration with commonly used servers (e.g., Windowsor Linux) poses a significant challenge for enterprise deployment.”
• Therespondents clearly articulated that “usability, more precisely, differences inthe presentation (UI) and process (UX) pose a challenge for the integrationinto employees’ daily routines.”

The Macquarie University study summarizeditself this way: “Our findings were confirmed by the user study, in which wemanaged to identify and order the most challenging aspects of FIDO2 adaptation(i.e., missing know-how, cost, and usability)… In particular, we hope our studywill be used as a guide for usability researchers as well as the FIDO communityincluding standardization bodies (e.g., FIDO Alliance), commercial vendors, andenterprises.”

While these data come from just one recentacademic report, FIDO is reported to be spending nearly a third of itsdevelopment budget to improve usability. This indicates the organization ishearing – and acting upon – the same usability message.

Legacy? Administrative? 2nd tier?

Whether IT teams consider them to be“second tier systems,” “administrative systems” or sometimes pejorativelydismiss them as “old legacy gear” there remain a lot of antiquated systems inthe modern enterprise.

According to research and advisory firmGartner, these are “information systemsthat may be based on outdatedtechnologies, but are critical today-to-day operations.” Gartner’s 2024research note “Use ContinuousModernization to Optimize LegacyApplications” cited survey data showing“47% of the respondents selected‘integrate, innovate and modernizeenterprise applications’ as a focus forthe next 12 months, making it the thirdhighest priority overall.”

Axiad’s experience withenterprise customers suggeststhat 1/3 of commercialapplications or services donot yet support FIDO.

Regardless of what we call them, mostof these systems cannot use FIDOauthentication processes or mechanisms.Axiad’s experience with enterprisecustomers suggests that 1/3 ofcommercial applications or services donot support FIDO and need to rely onother mechanisms. Many of thesedefault to password-basedauthentication methods, and thereforeinherit the security and usabilityproblems of password-only systems.An emerging best practice for theselegacy solutions is to combinecertificate-based authentication withknowledge-based systems, giving ITteams an additional, transparentauthentication factor for greater securitythat doesn’t impact or hinder users.

Challenge #2: The heterogeneous enterprise

As modern enterprises have evolved it’sbecome more and more apparent there’s no such thing as a “one-size-fits-alltechnology.” Diversity has increased in modern networks rather than decreased:

• The OS mixturecontinues to move towards a blend of platforms. Computerworld stated in 2023 that“Ten years ago, Windows held 85.6% of the US desktop share to macOS’s 12.86%.Today, Windows is down to 53.43% and Apple has seized 31.34% share.”
• The same istrue for Linux desktops as well, with Ars Technica reporting earlier this yearthat “Linux was on 6.34 percent of computers if you count ChromeOS.”
• Smartphonesand tablets are distributed in enterprises at 70% or more using Android OS and30% or more using Apple iOS.

Why does this matter to an organization’sFIDO strategy? It’s possible FIDO support is not as heterogenous as yournetwork is, or as deep as your plans are. While support for basic FIDO featuresis broad across platforms, support for advanced features – like startup fromboot through user login, or the ability to use device-bound passkeys, or obtaindevice attestation – is rare on Windows machines, and shallower still on otherplatforms.

Organizations planning to replace theirpassword-based authentication systems are best served by having a companionstrategy that leverages another authentication method where FIDO is not yet agood fit.

Challenge #3: Air-gapped and isolated environments

We’re in an internet-connected world, sothe “online” part of the FIDO name (Fast Identity “Online”) seems self-evident.After all, the original purpose of FIDO was to streamline authentication to asubset of the 1.09 billion websites active on the internet today.

Yet air-gapped environments – those thatuse discrete infrastructure and methods and forego standard internet connectivity– are still “common in military, government, banking, utilities, andmanufacturing” according to Gartner.

Despite claims that “the airgap is dead”because of the ongoing convergence of IT, OT and IoT, many cybersecurity teamsstill use air gapped architectures to defend their most critical data. A 2023report from ESG and KeepIt showed that more than 1 in 4 organizations (27%)used air gap designs in their networks as a critical defensive measure. Theseenvironments cannot leverage cloud-based Identity products like Microsoft EntraID, or cloud-based Identity and Access Management (IAM) products that provide aplatform for FIDO-based authentication functionality. Instead, they need toleverage new or existing on-premises authentication solutions.

Addressing the challenges: Filling FIDO gaps withcertificates and PKI

A powerful way to address these challengesis by layering in another authentication method to work hand-in-hand withenterprise-scale FIDO implementations. For this to work, the alternative mustnot only integrate well with FIDO, but it must also be cost-effective,understandable to architects and end users, and extensible.

Axiad’s Certificate-Based Authentication(CBA) for IAM uses digital X.509 certificates to provision and manage authenticatorsand credentials for end users leveraging FIDO. By integrating with FIDOtechnologies as well as X.509 functions, the product creates a consolidatedauthentication experience across OSs, tokens, and location. The productenhances security and further reduces end user friction.

How does Certificate Based Authenticationstack up to the 3 Challenges described in this brief?

• Usability at Enterprise Scale: It’s notuncommon to find large, Global-2000 organizations managing hundreds ofthousands of keys and certificates on a daily basis. For FIDO2 to be adopted atenterprise scales it needs the same sort of automation that solutions based onX.509 certificates leverage, but for the deployment, management and auditing ofFIDO-based credentials.

Axiad solutions provide this degree ofenterprise-wide manageability. While no one should claim that certificateconfiguration and management is “easy,” Axiad Conductor’s Certificate- BasedAuthentication for IAM and PKI as a Service solutions dramatically anddemonstrably reduce the overhead and IT burden of using certificates astransparent, strong authenticators at enterprise-wide scales.

• The Heterogeneous Enterprise: Certificate-based Authentication is ubiquitous. It’s a key part of theecosystem mentioned earlier that supports over 1 billion web sites in theworld. Applying certificates to enterprise endpoints as an additional layer ofauthentication covers gaps in MacOS, Linux and Ubuntu systems cited earlier, aswell as legacy systems still prevalent in many enterprise networks. If anorganization wants phishing-resistant across the board for all device types,and wants to retire as many passwords as possible, it needs a blendedauthentication strategy that leverages both FIDO and Certificate-based functions.

In reality, FIDO2 was never designed forenterprise use: it was designed to protect the privacy of the end-users, a goalthat often runs counter to an enterprise’s need for centralized management.Because of this, the current standard makes it all but impossible to create acontrolled rollout of passwordless implementations in the enterprise. The FIDOAlliance is working on addressing this gap, but certificate-basedauthentication methods are available today. These systems address the challengeof enforcing, controlling and reporting on the deployment of authentication atscale because the overarching schema was designed with many operationalsafeguards in mind. In fact, solutions like Axiad Conductor are now availablethat leverage manageability mechanisms built for certificate-based systems andcan apply those6 capabilities to FIDO2 credentials. This solution achieves truephishing-resistant MFA across the largest of distributed modern enterprises.

• Air-gapped and Isolated Environments: Certificate-based Authentication can provide local machine-to-machine,client-to-server, internal hosts, or machine-to-intranet authentication even ininternet-disconnected environments like air-gapped networks. Effectively, thoseenvironments where users need to access legacy or web applications hostedon-premises or in data-center servers, over the LAN/WAN or VPN, connected byFiber, MPLS, or leased lines.

Axiad’s Certificate-based authenticationsupports a full range of authenticators, and even enables multipleauthenticators, each with different credentials that can be assigned andmanaged per end user. In this manner, any mix of ongoing and temporary(project-based) authentications can be managed by a centralized system.

‍