Strengthening Cybersecurity in the Face of Rising Threats

Recent reports from the FBI have shed light on the escalating cyber espionage activities orchestrated by state-sponsored actors, particularly those emanating from China. The emergence of the Volt Typhoon botnet, as highlighted in The Guardian and AP News, underscores the critical need to safeguard sensitive information and ensure the integrity of digital identities.

Understanding the threat landscape

The FBI's warnings regarding the Volt Typhoon botnet and China's espionage activities highlight the sophisticated tactics employed by cyber adversaries. Recently there was Midnight Blizzard, the Russian nation state attackers on Microsoft. These threats pose significant challenges to national security and expose vulnerabilities in identity verification and data protection. The threat landscape is expanding.

Luckily, the threat was prevented

The threat was thwarted before an incident occurred. In the case of the Midnight Blizzard attack on Microsoft, we were not so lucky. The warnings signal what's coming for all organizations and confirm this will not be the last time a foreign entity or any other hacker will target the vulnerable.

What should organizations do to keep themselves out of the headlines? First, keep up with applying security patches and up-to-date versions of the OS and application layers. Good system management hygiene is a must.

But bad actors log in as frequently or even more often than using sophisticated hacks to gain access. Many organizations are minimizing dependence on passwords, but they are finding that the big challenge is addressing the many authentication use cases.

Windows Hello for Business conveniently supports passwordless access within the Microsoft platform, but try getting this to work with Mac OS, Linux or even your VPN. Domain controllers and virtual machines, for example, continue to depend on passwords. To the delight of hackers, the resulting "passwordless strategy" resembles Swiss Cheese more than a Swiss Army knife supporting the broad range of needs enterprise wide.

On the path to eliminating passwords, the diversity of information technology needs to be managed, and for good reason. Most enterprise IT environments evolved over decades as did security standards. There should be little to no expectation that somehow magically all ways of authenticating into this morass would happen with hand waving or a black box that effortlessly solves all unanticipated authentication use cases.

Identity can't be sufficiently managed with a password, an SMS code or knowledge of mother's maiden name. This is not new. A long list of three letter acronyms including IGA, SSO, PAM, and IAM all recognize identity as a corporate asset that needs to be managed and governed. None, however, seem able to keep up with the unrelenting attacks using social engineering and pirated account credentials. You just need to read the headlines to know this.

Closing the open door

At 1Kosmos, we've always approached passwordless MFA as a feature, but we've viewed the root cause authentication issue as a business challenge revolving around identity. We solved that by performing identity verification and then generating as an artifact a non-phishable passwordless MFA credential with liveness detection.

As our passwordless journey continued, something interesting happened. We found that placing identity outside of the application platforms and providing for various levels of identity assurance tuned to the risk of the digital interaction helped us rapidly evolve our identity and authentication platform to address the constant stream of use cases that surfaced in just about every customer deployment.

Not everybody wants an app, not everybody owns a mobile device, and some work environments outright prohibit the use of mobile handsets. By offering identity verification and authentication in a single privacy-by-design platform we've provided ourselves and our customers an elegant way to systematically accommodate the unexpected, and in a sense, hardest-to-solve authentication use cases.

This approach to identity modernization quickly augments core identity and access management to mitigate risk, reduce technical debt, and enhance access controls, effectively closing the open door that many hackers walk through unchallenged. By way of example, we've been able to rapidly release app-less authentication, browser-based identity verification journeys and most recently 1Kosmos 1Key, a biometric security key.

At 1Kosmos, we believe that by integrating identity proofing, credential verification, and strong authentication, we equip organizations with the tools and insights needed to combat identity-based attacks effectively and in ways not possible before.

Through a collaborative and identity-centric approach to security, we help organizations bolster their resilience and navigate through this digital storm unleashed by sophisticated attackers like those behind Volt Typhoon.

Prepare now for what may come

Given the advanced warnings from the FBI regarding the Volt Typhoon botnet and China's espionage, we were lucky this time. But this sequence of events telegraphs the dangers that live among us and should trigger heightened security measures, starting with identity verification at first and every login for customers, workers, and citizens.

Embracing innovative technologies enables rapid business innovation. This is the path forward to reduce risk and deliver order-of-magnitude business improvement for organizations that thrive on the speed of innovation and want to de-risk their business plan by modernizing and simplifying identity and access management. This is the future we at 1Kosmos envision for all organizations navigating digital transformation and the delivery of digital services.