house
[Music]
so my name is Andy jaw and I'm a senior
technical specialist with Microsoft in
security and today I'm going to talk
about passwordless authentication and
its impact on security
so the goal is to try to make
passwordless authentication in everyday
part of life where for the normal users
they're not really ever entering in
their passwords I work with mostly
Enterprise customers so usually large
customers who have an Enterprise
agreement with Microsoft already
but of course some of these Concepts
will apply to small businesses as well
as your personal accounts so if you're
using a Microsoft account with like your
Xbox Live or your personal Windows
computers there's accounts that you can
use passwordless authentication with
that as well
a lot of reasons why we want to get rid
of passwords I think most of us agree
that they are terrible
um you know they're they're hard to
remember we need vaults and because of
the vulnerabilities with passwords we've
added mitigations like MFA which are
also not as good
um
the way that we think about passwords
there's often anti-patterns to them so
when we type a password if it's if it's
something that we have to remember it's
always going to be something that is
similar to how we write languages so
like a sentence so you're always going
to put the capital letter at the
beginning generally for most users
they're going to type a bunch of
lowercase letters a number and then our
punctuation or exclamation mark is
always going to be at the end and that's
an anti-pattern for most
most passwords
and and I'm generalizing because
obviously if we're surrounded by
Security Professionals here you're
probably like I use a totally random
password I put in a password Ball but
you got to think like the majority of
users are going to set something that
they're going to try to remember and
that's going to be the way that they
they scope it out
if you are using vaults that's also kind
of another mitigation because again
passwords is the problem and vault is
really not a solution it's just another
mitigation that we have developed to try
to store all of these things and now
we're putting all of our eggs in one
basket which is probably okay but if
you've been following the news there are
have been breaches to vaults and
um you know as Security Professionals we
also don't feel great about vaults right
like we put all of our passwords in
these vaults and
it's again if you breach the one thing
the keys to the kingdom then of course
they have everything so not something
that again we would like to get rid of
which is why moving to passwordless is a
better solution
like I said nobody likes passwords these
are some of the stats some of them are a
little bit old but I'll point out the
one at the bottom here which is just the
increasing number and frequency of
attacks on passwords
when this presentation was first made it
was about 500 per second which was about
2021 in 2022 the number was pulled from
the Microsoft defense report and that
was around 700 which was about a 90 80
increase and then just recently
Microsoft secure happened this last week
on Tuesday and the number was
1247 password attacks per second so just
continuing to increase because it's
automated and things are a lot easy to
just Spam a password and you know a lot
of stolen passwords these days so
continuing to increase so another reason
why
um 2fa MFA again nobody really likes
these either
users don't like them their pain again
it's a mitigation against the problem
which is a password so
I we would like to probably get rid of
MFA if at all possible
but because it's a necessity right now
we can't
so a lot of different ways that you can
Implement passwordless authentication so
I'll go through a couple of them I won't
do a huge Deep dive but if you do have
questions on how this stuff is
implemented or more technical things
happy to talk with you I'll have my
contact information in the presentation
as well as we'll give some chances for
questions at the end here
for Windows there's Windows hello for
business which is different than Windows
hello which is the consumer version of
passwordless authentication and that's
okay but Windows hello for business is
an Enterprise solution which has
asymmetric
cryptography backing it and then the
Microsoft authenticator there's other
idps out there that also have
passwordless integrated with their
Solutions like I used to be an OCTA
admin and so OCTA does also have
passwordless authentication that you can
do and then of course 502 security Keys
which is
a stronger form
fish resistant and kind of all the rage
these days because of the different MFA
attacks that have been happening like
MFA bombing or you know some even the
evil Jinx attacks which are a little bit
more trivial
um that have been around for a while but
there are attacks against MFA which is
the point and so 502 being a physical
security key that you have to have if
I'm asked to put in if someone calls me
up and says hey I need your six digit
code you can't give it to them because
it's a physical key
so Microsoft has some documentation on
how to implement password strategy
and the first thing is just to deploy
them
like Windows hello for business or Fido
or the Microsoft authenticator so get
them out there configure them test them
in a in a pilot group if needed
and then move to reduce
password visibility which is
um
essentially from a user standpoint never
having to enter in a password so my
daily
work at Microsoft when I turn on my
computer I sign in with Windows hello
for business the device is azure 80
joined but this will work with the
hybrid Azure 80 join device as well
and
when I launch my
browser it'll single sign into my
applications that are Azure ad feder
Federated
and then
if I have to sign into a browser that's
not Federated or let's say it's in
private mode and I have to authenticate
it'll then prompt uh the Microsoft
authenticator for me to enter in a
number rather than a password I never
enter in a password and I cannot
remember the last time that I've entered
in a password probably the only time
that I've entered it in is two years ago
when I set the password when I got hired
so so that's the goal is to to deploy
the the solutions and then slowly start
to remove the visibility where
the password is no longer really a part
you may still have a password set within
the 80 object if you're on Prem and
you're using active directory services
but for all intensive purposes it
doesn't exist to the user because
they've never used it there is the
fourth one which is kind of like the you
know
let's aspire to get there which is
eliminate passwords completely the only
solution out there today where you can
actually just eliminate a password
completely from the identity is your
Microsoft consumer account so if you if
you don't know Microsoft or your MSA I
should say you can go in and actually
just remove the password completely and
that just means that literally on the
identity side for my andy.jaw at
outlook.com I don't have a password so
when I sign into
my computer
it doesn't even give me
an option to enter in a password on the
Windows sign-in screen if you're
familiar with the windows signing screen
this has different sign-in options
password is not one of them because I've
signed into that machine it's it's
mine with associated with the Outlook
account and I don't have a password with
it so that's kind of the fourth one
Enterprises Enterprise Solutions aren't
quite there yet I think that will combo
the majority of Enterprises are in a
hybrid state from the customers that I
talk to they most of them have an
on-prem identity like active directory
and then they sync that to the cloud and
so from there you just want to use more
of the Enterprise passwordless
authentication stuff
so Windows hello
Windows hello for business specifically
is
number one two-factor authentication it
uses asymmetric keys in order to pair
and authenticate it can be deployed in
multiple different ways fully on cloud
hybrid or on-prem and it can be used
with multiple accounts now there is a
limitation if you're not aware
for like a shared kiosk machine
the limitation of the TPM can only store
authentications for 10 accounts so if
you're in like say for manufacturing my
customers that I talk to quite a bit
they have kiosk machines or shared
machines on the manufacturing floor
if you're using Windows hello for
business you've got to keep in mind
number one you have to register that
every time a new user signs in so the
first time they sign in they have to
register the windows hello for business
either pin or biometric but it's limited
to 10 total who can sign into a machine
or you have to start deleting the old
biometric data from the machine and then
re-register new ones the better way to
do that if you're in a shared
environment is to use 502 keys so that
you know whether it's a USB or what I
found that works really really well
that's available today are like NFC
cards so you can use like an NFC a lot
of people have access controls to get
into the building you can use the same
NFC card to get into the building and
then also authenticate to your machine
privacy concerns come up quite a bit the
windows biometric data that is used for
Windows hello for business never leaves
that machine it's never shared it's
never taken to a different server it's
local to the machine and the the
Biometrics creates a data file that's
kind of like a
for layman's terms we'll just say it's
like a hash right it is one way it is
not reversible so if I had the biometric
data file which you can see right here
it's it you can navigate to it
I can't reverse that for your Biometrics
and it doesn't take like a fingerprint
it takes like a pattern then creates the
data file from it so that
it's used for the unlocking of the
machine
and here's kind of a
another graphic to kind of show you is
one way so it uses the biometric data to
create an ID that ID is then used to
unlock the device if I have the file I
cannot just reverse engineer it back
so I wanted to talk about pin versus
password just for a few minutes because
this often comes up
Windows hello for business has you know
like when I talk to customers they're
like well all of our computers don't
have an infrared camera or we don't have
a fingerprint reader
you can Implement Windows hello for
business with a pin and it works
perfectly well and there's a reason why
pin is better than password so if I have
your password that is transmitted over
the wire and I can then authenticate to
your user if I had your user ID I can
authenticate two services using that
username and password if I have your PIN
I only have your PIN for the device that
you have Windows hello for business
enrolled on so think about it from this
is very a very easy way to think about
it and explain it if you have to pitch
this to someone like let's say you're
pitching like I want to enroll everyone
in the company boss see so whoever it is
um think about it from your phone
standpoint if I had your Google account
username and password let's assume you
don't have MFA I can then sign into a
lot of things I can access your Gmail
account but if I had your PIN to your
phone
I have to have your phone right if I had
your username and password I could go
anywhere and and sign into stuff but if
I have your if I had your PIN to your
phone I have to have your phone
in order to sign in right same thing
with apple if I if I had the if you had
the PIN to my phone you have to have my
phone in order to authenticate but if I
if you had my iCloud password assume I
don't have MFA enabled then you can sign
into a lot of things same thing here
same concept right if I have a pin it's
local to the device you can set the same
pin on all the different things right
obviously if I have two different
iPhones I can set the same pin or I can
set different pins they're still
authenticated to me
um
but yeah enrolling Windows hello for
business I don't want to beat that horse
here but even with a pin it's still very
very good and users appreciate it
because your password requirements
probably like 12 characters you know
alphanumeric all that stuff pin you can
it's it doesn't follow the same risk
profile because it's local to the device
so don't apply the same rules that you
would for password rotation if you're
still using password rotation pin should
be a lower risk factor because it's
lower to local to the device at
Microsoft just as an example we use
minimum six digit PIN
non-expiring so it has to be six digits
at least mine are usually longer but it
just has to be six digits never expires
can be the same one on multiple devices
um and of course you can see here like
Windows hello it does create a a pin
which is like on a like say Windows 10
or 11 home machine which is a
convenience pin it still stores the
username and password and then it
releases that when you use the
convenience bin versus Windows hello for
business which uses key base or
certificate-based authentication on the
back end which we'll talk about in a
little bit
um yeah I talked through this slide
already so uh if you want to take a
picture or whatever go ahead but yeah
it's
pin is always is better than a password
even if you don't have biometric devices
on your machine in order to authenticate
via your face or fingerprint
still implement it because users will
appreciate it
okay we'll talk about deployment models
real quick for Windows hello for
business there are six deployment models
total today
for them are kind of redundant and I
won't touch on two of them so there are
two that are key trust and certificate
trusts that are like domain key trust
and domain certificate trust and then
hybrid key trust and hybrid certificate
trust they're mainly the same with the
exception of the ones that are domain
it's if you're only on-prem
completely so you have active directory
joined machines you're using Exchange
on-prem you're using SharePoint on-prem
you have no o365 presence there are very
very little customers who are like that
today so if you are it's you're within
the minority
um so hybrid key trust and hybrid
certificate trusts are more common
there are positives and negatives to
both of them but certificate trust
requires you to have at least 2012
domain controllers and
you have to have a robust pki
infrastructure issuing user certificates
so if you have someone who knows pki and
you're issuing user certificates you can
have those certificates be the key to
then authenticate against ad against
on-prem ad in order to unlock the
machines with Windows hello for business
um key trust is a little bit easier you
still need to have pki services but you
don't need to issue out user
certificates
so the key is then escrowed within the
domain controllers and the domain
controllers do the authentication within
against the key and you have to have
2016 domain controllers in order to
support this so if you are using
keytrust you want to validate how many
authentications you're probably going to
have and you need to have enough 2016
domain controllers to
support all those authentications
um there's really no like uh like main
difference but one use case for
certificate trust that Still Remains is
if you want to use passwordless
authentication to authenticate to RDP
for servers and if you're going to do
that it has to be certificate trust it
won't work with key trust so if that's a
use case that you're looking for
you're going to need to go with
certificate Trust
well for user computers you can do
either one and this is for hybrid
Solutions
um
there's other ones which is key trust
and this is obviously the easiest one
this is if you're using Azure ad join
devices and you're just authenticating
against Azure ad super easy to do if
you're using InTune if there's like a
check box you just say turn on Windows
hello for business and it will do the
enrollment and then escrow the key
within the user object in Azure ad
and you never have to talk to on-prem so
it just does the the exchange with the
cloud
you just have to have a
internet access right
um very there's there's no on-prem
infrastructure required
hybrid key trust like I said does
require oh I'm sorry hybrid Cloud key
trust is the newest model that is out
today and it's greatly simplifies hybrid
uh key trust deployment so instead of
using your on-prem domain controllers in
order to do this
you have to enable Azure ad Kerberos and
so the Kerberos object in Azure ad will
then do like a a TGT exchange with the
on-prem domain controllers
the the simplification comes in the fact
that you're using you have to enroll it
on-prem first so this is a hybrid
deployment still so the initial
enrollment still has to have line of
sight to the domain controller
but after that you never have to talk to
the domain controller again it uses the
Azure ad Kerberos object which has to
have an object within ad on-prem to then
do the Authentication
so and it's it's super easy to deploy
you just need a couple Powershell
obviously you need to be a domain admin
and a global admin but once you have
that it's like a Powershell command to
deploy the Azure ad Kerberos object
the users you still have to deploy the
policy whether it's within InTune or or
group policy and then after that the
user
after they enroll they just never have
to be on VPN or be on Prime in order to
authenticate which is different than the
hybrid deployments so hybrid key trust
and hybrid certificate trust like I said
there is infrastructure on-prem it does
communicate with the on-prem domain
controllers and so you know
take that as you will
um
all right Microsoft Authenticator
this is also the MFA
it now can also be used for
multi-accounts so previously the
password authentication the passwordless
authentication where you have to
register your phone for the phone sign
in was only scoped for one one account
one Corporation now can be multiple ones
um
it's pretty easy to implement in order
to have passwordless authentication you
have to go to the authentication methods
drop that down to any or password list
if it's on push it won't be passwordless
it'll it'll require the user to enter in
their password first and then prompt for
a push on the authenticator with
passwordless they don't have to do that
there have been some improvements as
well these are all generally available
now so you can use number matching you
can show the application name and the
geographic location so previously I
think when it first came out it was just
the prompt of approve or disapprove then
it went to three numbers as you saw in
the previous slide which technically
still had the one in three chance of
someone like MFA bombing selecting the
right one now you have to enter in a
number between uh I think it's one in 99
so it's a smaller chance of actually
guessing the right number and that's
just like with all the MFA bombings
people are getting all these different
prompts you can then see or what
application I signed into where the
egress IP is coming from and then
entering in a number so it's just more
context for the user
so 502 security Keys instead of
escrowing the key within the TPM let's
say for like authenticating to Windows
which is one way that you can Implement
502 Keys it escrows it within the 502
USB device or NFC device or whatever it
is so you just need that to authenticate
to the machine you can also use not to
be confused with other password lists
but you can also use the security keys
in order to authenticate to Azure active
directory Federated applications or
other idps right so like if it's OCTA or
whatever you can use a 502 to
authenticate to those applications which
is different than authenticating to the
machine but you can do both with 502
but also Windows hello for business is
also certified as 502 so you could just
use Windows hello for business without
the 502 key
if you're like in compliance or whatever
and you need to pass an audit it counts
as 502.
and it counts as MFA because it's
something you have which is the device
and something that you are or know which
is the PIN or your biometric
so again for those audit folks who need
to pass yeah
all right a lot of different ways to do
it like I said there's um
some some USB Keys which require just
like a touch some of them require
um a biometric if they require a touch
they'll have a pin associated with them
so again there's always going to be some
sort of authentication required even for
the NFC USB Keys another way that you
can do passwordless
is you can because Windows hello for
business is a 502 method
you can use the TPM and windows hello
for business
as the 502 security key for Azure active
directory Federated apps so the way that
works is
instead of inserting a USB I
authenticate the windows hello for
business and that counts as the 502
um
Authentication
authentication strengths still in
preview today
again this is born out of all of the
different MFA attacks that we've had so
you can use conditional access to
specify the level of authentic
multi-factor authentication that is
going to be required so if you have
admins and you want to force a 502 or
you want to make sure that users are
enrolled in in passwordless
authentication you can then scope this
as as a conditional access for accessing
a certain application
or all of the applications if you want
here's a screenshot showing you of the
policy so if you're acquiring
authentication strength which is the the
condition
or you could just do multi-factor
Authentication
okay so some of the benefits
I call it a security unicorn
passwordless is a security unicorn
because it's one of those few things
that we do as security practitioners
that not only makes it more secure but
it's also a better experience for the
user right like most of the time when
you talk to users about implementing
something security they're like oh man
like what am I going to have to do now
but this is a better experience and most
people appreciate it especially the
executives I've deployed this at many
companies and every single time it's the
executives who come up to me and like
this is the best experience I've ever
had and how do we do this for everyone
in the company so
um of course like if you don't have a
password or you're never using it or you
don't know it you can just set something
super long and just forget about it and
it can't you know
for a user if I'm never using my
password I'm never going to be fished
for it I'm never going to it's you know
it's really hard to brute force that
stuff because you just set something
super long
like I said it counts as MFA for Windows
hello for business because it is
something that you have which is local
to the device and something you are or
no cost effective something that doesn't
come up quite a bit but it is because if
you ever ask like a help desk person how
many times they have to reset the
passwords for users how many tickets
that you have
it probably is quite a bit so I've never
called the Microsoft help desk to reset
my password ever and I'm pretty sure
they never get any of those calls from
anyone so the number of support tickets
go down quite a bit
it's also an extra warning signal so
I'll tell you a story because I never
have to enter my password
but I did
um
a B2B connection with another
organization that didn't have
passwordless enabled or didn't have the
same policies but I was able to use my
Microsoft account against theirs in a
B2B connection
well as soon as I connected it prompted
me for a password and it was for my
Microsoft password and I immediately was
like is this phishing or what is this
because I never have to enter in my
password
so if you have passwordless deployed
anytime a user gets prompted for a
password they're immediately cautious it
turned out to be legitimate because it
was the organization I was trying to
connect to
but you know just another extra warning
signal for you
and then don't forget about single
sign-on which is also a very important
part of
passwordless strategy right you want to
use an IDP like Azure active directory
or OCTA or ping to Federate those
applications and then find a way to
allow users to single sign-on which is
when they launch a browser they launch
into a web app they don't have to enter
in their passwords because it's
Federated with your identity provider
here's kind of a plan to go through
I won't
belabor this but definitely start with a
pilot always in it right start with a
pilot and I'm sure everyone in your
pilot will enjoy it
uh there are audit logs if you pull on
the sign in that you can pull audit logs
from if you're using Azure ad to tell
which method and you can even see if
they've enabled phone signed in for
passwordless authentication because it
is an extra step in order to do that so
the users have to register the MFA and
then they have to
enable phone sign-in within the
authenticator to do the actual
passwordless Authentication
and then the final one there disable
your password for your MSA like if you
have a Microsoft column if you're using
Xbox
or you have personal Windows computers
just go into the account and remove the
password and then you don't have one you
just use the authenticator to sign in
and it's great because like if I sign
into a new Xbox I don't have to enter in
my 30 character password on my Xbox like
controller I just get a prompt I hit OK
and I'm signed in
here are some Resources contact
information for me if you have any
questions
and we're pretty much at time so I'll
stick around if you guys have any
questions but that's my presentation
all right
[Music]