Developing Device Trust
The IT model for your company should include information on the devices you are familiar with and how much you trust them to use your corporate services. Static workstations on site and more and more mobile devices that go with your users are included. Reputable gadgets can:
- successfully limit the range of locations from which a credential may be used, enhancing the authentication offered
- Give organizations the option to divide user-to-service authentication into two distinct functions: device-to-service and user-to-device.
User-to-device authentication
The user first has to authenticate themselves to a device. This will need to be robust and rely on more than just a password. For example:
- Multiple factors are needed for the device’s first “bootstrap” authentication in order to register and link a user’s identity to the device. For instance, a hardware security key with its PIN or a user password plus an existing MFA app.
- continuous authentication, in which the user’s registered device may now serve as a trusted possession factor for their authentication, making subsequent multi-factor authentication easier. Using a PIN or biometric attached to that device, for instance.
Device-to-service verification
A trusted device can keep a credential and use it to authenticate to internet services on behalf of its user once it has successfully authenticated the user. In order to provide some of the security advantages of zero trust architectures, this will incorporate both the device’s and the user’s identities.
The device must be reliable enough to preserve and safeguard the user’s digital identity, which is the crucial connection between the user authenticating to the device and that being transmitted to internet services. Only after the device has been set up with the proper mitigations can that confidence be earned. You must be certain that the device and its apps have been built to employ secure credential storage, regardless of the management type you choose. Typical credential storage choices on contemporary devices include the following:
- Keychain on iOS, iPadOS, and macOS
- Windows Hello for Business
- Identity-as-a-Service authenticator apps (such as Google Prompts, Microsoft Authenticator, Okta Mobile, and PingID)
Recommended types of multi-factor authentication
CYBERSECURITY SMART AWARENESS
Follow us
USEFUL LINKS
GCHQ
MI5
SIS
NPSA
ABOUT CSSA
What we do
What is cyber security?
Equality, diversity and inclusion
Incident management
Leadership team
Careers
ABOUT THIS WEBSITE
Privacy notice
Cookies
Accessibility
Terms & conditions
Social media policy