A Farewell to Passwords
Why CISOs Must Break Up With the “Original Sin” of Cybersecurity
Imagine for a second that your entire multi-million dollar security infrastructure is being held together by a standard designed in 1977. Back then, we created password requirements (eight characters, uppercase, lowercase, special symbols) specifically to ensure a PDP-8 computer would take 60 days to crack it. We then arbitrarily cut that time to 30 days and told users to rotate their passwords every month. We are essentially fighting 21st-century cyber-warfare with a “disco-era” shield. It is no wonder that passwords are often called the “original sin” of cybersecurity.
If you’re a CISO, it’s time to realize that you aren’t just managing “login credentials” anymore; you are managing the new perimeter: Identity. When an identity is stolen via phishing or credential stuffing, your zero-trust network doesn’t stop the intruder, it actually works to protect them, because the system believes the attacker is the authorized user. To survive the modern threat landscape, we have to stop trying to “fix” the password and start planning its funeral.
The Myth of the Secure “Shared Secret”
For decades, we’ve relied on shared secrets. Whether it is a password, a one-time passcode (OTP) sent via SMS, or a “magic link” in an email, the logic is the same: you know a secret, the server knows the secret, and you prove who you are by sending that secret across the internet.
This is the fundamental flaw that enables phishing. If a user has to type a secret into a form, an attacker can lure them to a lookalike site (like evil.ru instead of microsoft.com) and intercept that secret. Even legacy Multi-Factor Authentication (MFA) is vulnerable here. If the secret can be seen, it can be replayed. We’ve been playing a “guessing game,” trying to score whether a login is legitimate based on typing patterns or geofencing, but at the end of the day, we’re still just passing secrets back and forth.
Enter FIDO: The Fast Identity Online Revolution
The FIDO Alliance, a consortium of over 300 industry giants like Google, Apple, and Microsoft, decided to change the game by moving away from secrets entirely. Instead, they embraced asymmetric cryptography.
In a FIDO-based world, you have a private key that stays on your device (your phone or a hardware key) and a public key that stays on the server. To log in, the server sends a mathematical challenge that only your private key can solve. Because no secret is ever transmitted, there is nothing for a phisher to steal or a man-in-the-middle to intercept.
The Usability Trap: Lessons from the USS Coronado
As a CISO, you know that if security is hard to use, your employees will find a way around it. Take the story of the USS Coronado in the year 2000. They installed an experimental eyeball scanner for a secure area. It took four seconds to verify an identity. Meanwhile, the old manual “cipher lock” buttons took only three-quarters of a second. Because of those extra three seconds, nobody used the high-tech scanner.
This is why Passkeys are a game-changer. They offer “Fast Identity Online” (FIDO). Whether you use a device-bound passkey (like a YubiKey that can’t be exported) or a synced passkey (which lives in a credential manager and follows you from your iPhone to your laptop), the experience is seamless. Users simply provide a biometric such as a fingerprint or face scan to verify their presence and consent. It’s faster than typing a password and infinitely more secure.
The CISO Playbook: Recommendations for a Passwordless Future
Transitioning to a passwordless environment isn’t just a technical shift; it’s a strategic one. Based on the latest insights from industry experts, here are five actionable recommendations for CISOs to implement in their organizations:
1. Audit Your “Back Door” (Account Recovery)
The biggest mistake CISOs make is securing the front door while leaving the back door wide open. You can have the most robust, phishing-resistant FIDO login in the world, but if your “Forgot Password” flow still relies on sending a phishable OTP to an email address, you haven’t actually solved the problem. Account recovery is just another authentication flow, and it must be as secure as the primary login.
2. Phase Out SMS and Voice OTPs Immediately
Legacy MFA is no longer enough. Regulatory bodies across the globe are beginning to recognize that SMS-based OTPs are fundamentally broken. In some regions, using SMS OTP for sensitive services is already becoming a violation of security regulations. Follow the NIST 800-63-4 guidance: move toward phishing-resistant authentication methods like passkeys and hardware tokens.
3. Secure the “Bootstrap” Window during Onboarding
A new employee’s first morning is a high-risk window. Don’t start their journey with a “temporary password” sent via email. Instead, consider pre-seeding hardware security keys and shipping them directly to the employee’s home, tied to their account. Alternatively, use biometric liveness detection and identity verification (scanning a government ID and a selfie) to strongly verify the user before they are allowed to create their first passkey.
4. Protect High-Privilege Accounts with Hardware Keys
While synced passkeys are great for general users, your Global Administrators and high-value targets should use device-bound hardware keys (like YubiKeys). These keys require physical possession and a “user presence” touch, ensuring that even a sophisticated remote attacker cannot gain access. As one expert noted, you can’t be phished out of a physical key.
5. Combat Deepfakes with Injection Attack Detection
As AI gets better, attackers are using injection attacks to bypass cameras during remote onboarding, replacing a real face with a deepfake video stream. When selecting identity verification vendors, ensure they have biometric liveness detection and the ability to detect if a video stream has been tampered with or “injected” between the camera and the application.
The era of the password (the “original sin” of our industry) is finally coming to an end. By moving toward a FIDO-based architecture, you aren’t just making things harder for attackers; you’re making life easier for your users.
Think not only about web services (yeah, for them MFA/ Fido2 - ok)
But what about zip-archives / lock-doors / phones protected by a password?