What is zero-trust security?

Everything you need to know about zero-trust security, and why you need zero-trust passwordless authentication like Keyless

Zero-trust models are a radically different approach to network security that can help companies strengthen security and eliminate cyberthreats.

At Keyless we’re helping enterprises transition to zero-trust security architectures with our breakthrough biometric authentication technology.

In this piece we’ll cover:

• The difference between trust-based and zero-trust security
• How to implement zero-trust security
• The Keyless solution: zero-knowledge biometrics

Trust vs Zero-Trust

Perimeter-based network security models, like firewalls and VPNs, automatically trust users who are inside the network.

Unfortunately, this approach leaves organizations susceptible to threats launched from within the network; while also failing to protect against incoming threats when systems are being accessed remotely.

Recent work-from-home orders are highlighting security flaws with the perimeter-based network security approach.

With the rapid rise of users accessing an organization’s systems remotely, (from outside the security perimeters of corporate firewalls), the chances of a successful breach have increased sharply.

Since legacy security systems rely on trust, once a hacker gains access to a network, they’re then able to freely move throughout the network until finding sensitive data.

Malicious attacks aren’t the only issue with legacy security systems. Trust-based models leave organizations susceptible to insider-orchestrated attacks and data leaks.

Thus the assumption of trust is fundamentally flawed, leaving systems vulnerable to an ever-increasing number of sophisticated attacks. As the classic saying goes “if it can get hacked, it will”.

With the growing threat of attacks, this is essentially true for all systems that store sensitive data and fail to adequately protect it. Zero-trust models can help organizations restore security and privacy.

Read more about why traditional security models are ineffective here.

What is zero trust security?

First coined a decade ago by an analyst at Forrester Research, zero-trust security models assume that all devices and users can’t be trusted. This assumption carries through after a user has initially gained access to the network.

Based on this assumption that a user cannot be trusted, zero-trust models continuously verify and authenticate users no matter where, when and how they access a system.

This protects organizations by preventing unauthorized movement within a network’s systems. As such, zero-trust security models protect organizations from the reputational, legal and operational costs associated with large-scale data breaches.

With cyberthreats increasing in sophistication and scale, zero-trust models can help transform security architectures and protect enterprises by offering new levels of protection, helping to ease the transition into a digital future where remote-work is commonplace.

How to implement zero-trust security within your organization

As the global workforce moves online, enterprises need authentication solutions that are not only secure, but dynamic and user-friendly at the same time.

We believe that modern access management is about the right people, having the right level of access at the right time, with the least amount of friction as possible.

The first step towards implementing a zero-trust security architecture should be to adopt secure passwordless authentication. The second would be to implement access controls at every entry point to an organization’s private systems and databases.

Access controls can be used to prevent lateral movement throughout the network, while ensuring that only privileged users have access to sensitive databases and private resources.

By establishing trust, (via re-authenticating), as the user moves through the network, zero-trust authentication prevents malicious actors from being able to launch large-scale attacks.

The zero-trust model also prevents unauthorized users or employees from accessing data that they shouldn’t have access to.

The Keyless solution: zero-knowledge biometrics

At Keyless, we combine multi-modal biometrics with privacy-enhancing cryptography with biometrics and state-of-the-art anti-spoofing technology to enable a passwordless, phishing-proof way to authenticate users, leveraging a zero-trust framework.

In doing so, we are able to offer seamless, ‘onelook’, multi-factor authentication for end-users and employees, across all platforms and devices.

Our solution offers strong multi-factor security, by design:

• For the first authentication factor, Keyless verifies users are accessing from a trusted device. If a device is not registered, the user won’t be able to authenticate
• For the second authentication factor, Keyless uses facial biometrics to verify users across every touchpoint — a universal inherence factor as an added level of security
• Soon, Keyless will involve behavioral biometrics, which serves as another, transparent third factor — across platforms and devices

In other words, users seamlessly authenticate simply by looking into the camera of their registered device. Our network verifies users in less than 100 milliseconds, less time than it takes to type out an email address and password.

By providing a secure, frictionless way to establish access controls at multiple entry-points, Keyless prevents unauthorized movement through private corporate systems.

This protects organizations from a range of threats inside the network, like malicious takeovers, insider attacks and data leaks.

To protect end-users and organizations from other kinds of malicious attacks, like fraudulent attempts to replicate a user’s biometrics, Keyless uses advanced liveness detection and anti-spoofing techniques to ensure that the user is in fact real.

Is Keyless the right fit for your organization?

• Nothing to remember: Keyless offers passwordless multi-factor authentication with just one look, across all platforms and devices.
• Nothing to steal: Keyless relieves organizations from having to store and thus protect and manage user’s biometrics and sensitive authentication data — with nothing to hack, there is nothing to steal.
• Enroll once, use everywhere: Keyless is compatible with all devices and systems. This is especially important as we transition to a remote working environment where employees will access networks from their personal devices.
• Privacy compliant: Keyless does not store or process personal identifiable information, which helps businesses comply with privacy regulations even as regulations change over time and across jurisdictions.
• Built-in anti-fraud protection: Keyless embeds phishing-proof technology and behavioral authentication to minimize the risk of account takeover, phishing, and credential stuffing.

Interested in trialing Keyless to enable zero-trust remote security?

If you’re interested in how Keyless™ authentication can help deliver secure and seamless digital experiences, whether for your end-users or for an ever more important and dynamic digital workplace, or if you’d simply like to learn more about our platform, then please feel free to get in touch with our team.

You can email us at info@keyless.io

We’re always keen to have a chat about how we can help businesses on their journeys towards a complete zero-trust security model.