Phising resistant MFA
summary
U.S. Executive Order 14028 and OMB memos require agencies to implement phishing-resistant MFA—only PIV smartcards and FIDO2/WebAuthn meet the standard; SMS and OTP push are explicitly unacceptable. Agencies must adopt zero trust and prioritize cloud identity (Azure AD CBA is already in beta). NIST-derived credentials let PIV or FIDO credentials reside in a phone’s secure element so users can authenticate from personal iOS/Android devices with hardware-backed keys like a YubiKey or platform authenticator.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:01Executive order overview
- 3:54Zero trust architecture basics
- 6:25Phishing resistant MFA explained
- 8:09PIV smart card technology
- 9:34FIDO2 WebAuthn standard
- 12:01Key takeaways from the order
- 14:33Derived credentials and BYOD
- 16:41Cloud migration priorities
- 18:04Impact on businesses and ecosystem
- 19:47Urgency and future security
related talks
23mPasswordless Authentication in the Regulatory MFA Landscape
17mImplementing Multi-factor Authentication
50mOne Does Not Simply Add MFA
50mA tale of two sides of 2FA
45mPanel: America Loves FIDO
17m2FA in 2020 & Beyond
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
34mWhat does ”MFA” mean?