To offer a better user experience and reduce friction, Cisco Duo Security Advisory CISO J. Wolfgang Goerlich argues that zero-trust strategy should combine passwordless and risk-based authentication.

“Passwordless authentication, more broadly, reducing the friction and the user experience, is the key user benefit in a zero-trust business case,” Goerlich told SDxCentral. “Combination of passwordless and risk-based authentication I think is going to be a very powerful one to take us into the future.”

Passwordless means authenticating without “everyone's long-hated passwords,” plus risk-based authentication that provides the end user with a better experience and offers CISOs more control, he explained.

Goerlich saw the biggest shift in zero-trust security as moving away from binary authentication to risk-based authentication technologies such as single sign-on (SSO) and Wi-Fi fingerprinting, which can reduce how often users get prompted to authenticate.

“We want to only ask people to authenticate as often as we need to reduce the risk of the organization, no more frequent than that. And when we do ask them, we want the experience to be as automatic and as simple as possible,” he added.

Wi-Fi fingerprinting allows setting the baseline for trusted locations while noticing location changes without tracking users’ location to ensure privacy, Goerlich said. “What Wi-Fi fingerprinting allows us to do is to say, look, this is a person working from their home office, working like they normally do, on a device that we trust, we should give them the freedom to do their job and we should give them the privacy to do their job, and really as much as possible to have security get out of the way.”

Cisco recently rolled out its Duo Passwordless Authentication for customers which includes risk-based authentication capabilities.

Internally, the company is continuing its own passwordless journey for all of its employees using Duo.

“Cisco continuously evaluates and adapts innovation and new technology to strengthen our security posture and give our employees the best working experience,” noted Jack Klecha, senior director of information security at Cisco. “Using Cisco Duo, we are currently piloting passwordless technology with a group of our employees for secure access to over 300 applications. Further roll out to all employees is planned by the end of this year."