Recently, JAXA (Japan Aerospace Exploration Agency) announced that it may have suffered multiple cyber-attacks from last year to this year, resulting in the leakage of confidential information. The server that was the target of an internal server attack after receiving unauthorized access from outside contained approximately 5,000 personal information records of employees and temporary staff. However, the company said that sensitive information related to security, such as rocket and satellite operations, was not affected.
Announced on June 21st, 2024.
Information leaks due to cyber attacks can damage the credibility of an organization and cause serious economic losses. In particular, in institutions that handle confidential and personal information, the outflow of information has the risk of shaking social trust. The lack of security measures so far is behind this incident, and the deployment of a strong security system is urgently needed.
Also, this incident highlights that there is a risk of hacking damage if there are no security measures somewhere. Generally, a single authentication with only an ID and password is highly vulnerable to cyber-attacks. In institutions where security is important, information should be highly protected, and security is urgently needed.
When considering security enhancement in authentication,multi-factor authentication (MFA) is said to be effective. There are various methods in bite of multi-factor authentication, but what kind of method is effective for future security measures?
One of them is Passkey.
FIDO's Passkey uses the public key encryption method to prevent password theft and phishing attacks. The user's authentication information is safely stored in the device and does not leak out. So you can maintain high security.
FIDO (Fast Identity Online) Passkey has some important points.
１． High Security
FIDO Passkey uses public key encryption and saves authentication information on the user's device. At the time of authentication, authentication is performed using a public key and the private key does not leak out of the device. This helps users prevent password theft and phishing attacks.
２． Phishing Measures
FIDO Passkey is not available on a phishing site because it is linked to a specific website or service. Since authentication is performed only on regular sites, it greatly reduces the risk of users being deceived by fake sites.
３． Easy to Use and Convenience
Users do not need to learn the password. So you can easily log in using biometric authentication (fingerprint authentication, face authentication, etc.) and PIN code. This makes the authentication process quickly and intuitively.
４． Passwordless Authentication
Using FIDO Passkey allows you to complete passwordless authentication. This eliminates the risk of password management and leakage, improving security.
５． Cross Platform Compatibility
FIDO Passkey is compatible with many devices and platforms such as Windows, macOS, iOS, and Android, users can be seamlessly authenticated between multiple devices.
６． Privacy Protection
The authentication information is saved on the user's device. So the service provider cannot access the user's private key. This protects privacy.
７． Industry-wide Support
FIDO Alliance has many large companies, such as Google, Microsoft, and Apple, and the FIDO standard is widely used. This has an environment where many online services can use FIDO Passkey.
From these points, the FIDO Passkey is an effective authentication method that combines high security and ease of use and is useful for both users and service providers.
See below for detailed explanations about Passkey:
Also, the deployment of physicality keys is one of the effective means.
FIDO-compatible security keys such as YubiKey function as physical tokens and enhance user authentication processes. This will further improve security by preventing unauthorized access and achieving two-factor authentication.
The reasons are effective for the deployment of physical security keys:
１． High-security Level
A physical security key is used as part of multi-factor authentication (MFA), which is required in addition to a password to access the account. This makes it impossible to access the account even if the password is leaked.
２． Resistance to Phishing Attacks
The security key used in FIDO authentication is designed to function only for a specific domain that has been registered. So it cannot be used on a phishing site. This greatly reduces the risk of users accidentally entering information on fake sites.
３． Easy to Use and Convenience
Once set, it is easy for users to authenticate simply by connecting the keys or connecting them with near-field communication (NFC) or Bluetooth. It is especially convenient for users who log in frequently.
４． Passwordless Authentication
Some services can fully use a physical security key to fully authenticate with passwordless. This reduces the burden of password management and memory.
５． General and Compatibility
Many physical security keys are compliant with the FIDO (Fast Identity Online) standard and can be used for major services such as Google, Microsoft, and Facebook. This allows you to use the same key in multiple accounts.
６． Long-term Cost Effect
Security keys are durable and can be used for a long time. So you can reduce the cost of password reset and account recovery in the long term. Although there is an initial investment.
For those reasons, the deployment of physical security keys is an effective security measure for many companies and individuals.
See below for details on security keys:
Our company's YubiOn solution is an advanced security solution that allows you to use Passkeys and security keys. Strictly manage access to personal information and confidential data, based on FIDO authentication. In addition, there is no impact on existing systems (local AD or Entra ID) and can be deployed quickly and easy to operate.
In addition, there is a solution that can use SSO. So you can select solutions according to the operation requirements. The effects after the deployment can significantly reduce unauthorized access, reduce the risk of confidential information, increase security awareness, and improve management efficiency.
The YubiOn solution reduces the risk of information leakage due to cyber-attacks and contributes to zero-trust security. The deployment of YubiOn solutions that combine safety and convenience is very effective as part of future information security measures. Deploying advanced authentication technology such as multi-factor authentication (MFA) can enhance security and significantly reduce the risk of information leakage.
Furthermore, the importance of zero trust security is increasing. Zero Trust verifies all accesses regardless of whether they are inside the network, based on the principle of "Do not trust, always check". This approach can minimize risks in areas where internal threats and conventional border protection are not extended. By combining multi-factor authentication (MFA) and zero trust, companies can build a more robust and comprehensive security system and further reduce the risk of information leakage.
See below for more information about the YubiOn solution: