Cyber Defense eMagazine December Edition for 2021

lock-in, and lets organizations take advantage of any MFA method, including the latest and safest
authentication standards, such as FIDO2.
The example comes from above
Due to the fact that MFA is a method that effectively protects organizations against phishing and
credential theft, governments of many countries around the world have also become interested in its
adoption.
A few months ago, on May 12, 2021, there was big news in the cybersecurity world - the president Joe
Biden signed an executive order to improve the nation's cybersecurity. The order called for the
implementation of two-factor authentication (2FA) for the entire government within 180 days. And at
September's Authenticate Virtual Summit, users, experts and vendors from around showed many case
studies of how strong authentication helps with securing online identities. Participants, including
representatives from the UK's National Health Service (NHS), US’s login.gov and the Internal Revenue
Service (IRS), agreed that authentication and protection of digital identities is a top priority today and in
the future.
FIDO2 rules
2021 has shown that the way world governments think about MFA is fundamentally changing. The role
of FIDO2, a global, open authentication standard developed by the FIDO consortium and then approved
by the W3C (World Wide Web Consortium), is growing rapidly. It seems that FIDO2 authentication is no
longer just yet another authentication option but it is becoming the preferred choice of many government
institutions as well as private organizations.
How does it look in practice? For example, the governmental Canadian Digital Service has implemented
hardware security keys that support all FIDO2-based methods. The authentication process with their help
is very simple - when logging in, e.g. to email, you have to enter the password and additionally
authenticate by inserting the security key into the USB port and pressing a button. In case of CZ.NIC, the
Czech DNS registry, also accredited by the national digital identity provider and by eIDAS mojeID,
800,000 users can log in to government services based on FIDO2 from September 2021. In Sweden, a
digital identity system has been implemented in the educational eduID portal with support for
authentication using the Universal Second Factor FIDO (U2F) protocol.
In the USA, the American Login.gov service is based on the FIDO2 standard as well, and in the United
Kingdom the UK National Health Services Login application uses biometrics. Similar practices are
followed by the Korean government - a second component, fingerprint biometrics for 14 million users -
and Thailand, has a dedicated website that helps organizations set up multi-factor authentication using
FIDO technology.
Overall, the government's move towards MFA to provide a scalable and cost-effective form of strong
authentication is perfectly understandable. Governments and public organizations are forced by the
Cyber Defense eMagazine – December 2021 Edition 74
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.