What passwordless means for the healthcare sector

This month, we had an enlightening conversation with healthcare specialist, Joy Poletti, who’s worked as the VP of access and governance operations and program delivery. Joy brought over ten years of experience in access governance to the table, targeting healthcare sectors. Joy’s counterpart is our very own Ryder Gaston, WinMagic’s Chief Revenue Officer. Ryder brings a wealth of product knowledge to the table, along with what it takes to go truly passwordless. Our conversation with Joy brought to light many aspects of the medical sector and the pain points involved in user authentication. As she mentions in our conversation: “Can you imagine having to stop in the middle of some kind of surgery or any kind of procedure to reset a password? There's no time for that, that's just not acceptable.” What’s more, Ryder had a great solution on hand. Watch the full video on LinkedIn What is passwordless? “Passwordless” is becoming a hype word. So much so that it’s being thrown around without many companies or individuals knowing exactly what the idea means. Early in our conversation, Ryder took a moment to iron out any confusion. Passwords have been around since the 1970s. Over the years, they’ve become the most vulnerable security point for organizations. Passwords are susceptible to cyber-attacks, phishing scams, and other risks. “Any kind of state agencies coming into organizations are really looking for compromising those credentials.” - Ryder Gaston The notion of passwordless stems from the need to reduce the friction between passwords and the user — users forgetting passwords, writing them down, sharing them, and more — while also increasing security around authentication. “Whether [authentication] was at the pre-boot of your disk encryption, sitting at your desktop, logging into your VPN, or just hitting a specific application that might still require credentials, it became very complex for the communication side of the house to really streamline.” - Ryder Gaston In our post-pandemic world, more people are working remotely than ever before. Some people travel to and from the office, creating a risk factor and level of friction as they need to authenticate themselves from place to place. When users get locked out in remote conditions, it’s particularly difficult to get their account unlocked. “What we're hearing, in general, is users being locked out of their systems across the board. This is just resonating left and right. People not being able to do their jobs is very, very frustrating.” - Ryder Gaston Now that remote work and network access are here to stay, the authentication industry is making a huge pivot, working to reduce user friction while increasing security at the same time. A frictionless experience has the potential to boost productivity by making sure users can reliably access the network and stay online. “We've seen a massive uptick in productivity issues during COVID and post COVID, based upon this restriction of passwords.” Healthcare pain points. Healthcare is incredibly focused on patient care, taking urgency to the next level when it comes to system availability. Health practitioners need a rapid authorization process to log onto their digital systems. The sector experiences pain points from both a functional standpoint and a security perspective. Caught in the moment, hurried healthcare workers will write their passwords down just to remember them. Or, they’ll share their password with a coworker, which is another blatant security risk. Joy believes that the healthcare sector needs a different solution. One that enables physicians, nurses, and frontline workers to access confidential patient records on-the-go without having to remember a username and password. “In health care, the patient care comes first. We've got to find a way to do better.” - Joy Poletti Other pain points can be found in the merger and acquisition process that healthcare organizations frequently experience. When two groups come together, they each bring their own systems and software. As a result, there are multiple sets of credentials healthcare workers need to know. “If a physician only needed to remember their login ID and didn't have to worry about their password, that would be a huge satisfier. […] We wouldn’t be asking physicians to reset their login ID every 90 days.” - Joy Poletti In part, due to these complex structures, physicians and specialists are driven to their “wit’s end.” Healthcare organizations end up losing their most valued employees who are on the frontline taking care of patients. Other pain points. While the above pain points in healthcare can be extremely restrictive, Ryder shared his thoughts on how passwordless can help iron out the experience. From working with multiple healthcare organizations over the years, the WinMagic team knows that any delays can cost lives. Going passwordless can reduce the friction of user authentication and let health practitioners focus on their jobs. Another area of friction is the criteria for passwords. They need to be updated every 30, 60, or 90 days and must follow an unreasonable set of criteria for complexity. “They tend to make those passwords something they can remember very easily. […] And they'll continue to use the bare minimum of complexity.” - Ryder Gaston More recently, NIST 800-63 guidelines are telling companies to not make their users change passwords regularly. Instead, complex passwords of 13 to 14 characters have proven to be secure. Well, NIST has addressed one problem, but there’s still the issue of passwords being too complex for most users to remember: “somebody is going to get compromised.” In fact, “80 to 90% of all compromise is based upon a credential being taken over.” This statistic has been the same for the past decade without improvement. As Ryder asks, “why has this not changed yet?” Now, with such a shift to remote and hybrid working, the world is starting to transition. Organizations are focusing on security and getting rid of passwords: one of the most prominent security risks. Unfortunately, the shift won’t be easy. While many leading software providers are looking at passwordless authentication, legacy software will still require usernames and passwords for years to come. So, as Ryder articulates, “the way you start looking at what password is: How do you give all these values that we're talking about this reduction of friction — this increased security?” Passwordless is a framework that allows users to orchestrate communication between devices to authenticate themselves. Ultimately, the password is “the framework conversation on the path of zero trust.” Pre-boot authentication. One often-overlooked aspect is the pre-boot side of user authentication. Nearly all disk encryption solutions require a username and password to authenticate. So, if a third party were to compromise your system and had your username and password, they could log into the system and pull data, even cached content, and potentially compromise your network credentials. Taking the password out of your OS experience, whether with Linux or Windows, all the way into your applications, can bolster security. A perfect healthcare world. Joy believes that, in a perfect scenario with single sign-on (SSO), the user should have just one set of credentials. However, particularly in the healthcare sector, people are faced with mergers and acquisitions that bring ancillary systems without SSO configured. “It's one thing when you're asking your IT staff to understand that and remember multiple credentials, but when you've got physicians, nursing staff, and healthcare workers on the front line who are going a million miles an hour from patient to patient — time is money.” - Joy Poletti Aside from money, there’s the factor of urgency based on a patient’s situation. The concern “really takes the whole ‘not being able to log in’ to the next level.” Now that passwordless is a possibility, healthcare institutions are looking for a solution that shifts the authentication responsibility away from the physicians to a trusted device instead. This shift would allow specialists to do their job in a timely matter without the hassle of calling the service desk every time they have trouble logging into the system. Service desk queries can get bottlenecked. Either the service desk personnel don’t have ready answers, or they’re juggling too many service calls. This challenge creates frustration throughout the system and delays patient care, which is unacceptable in healthcare. Considering costs, “think about the money you would save, if you cut off all those calls to the service desk for password resets and unlocks.” For the health sector, Joy would love to see the responsibility of authentication alleviated from the front line and in the hands of a solution that offers the right amount of security. “You really have to look at that risk and cost in that full picture of what you're signing up for.” - Joy Poletti Looking forward. With a new world of authentication on the horizon, there’ve been many conversations about the differences between authentication, verification, and how they interact with each other. By authenticating a verified device and user, the device will be authorized to access your applications based on the roles the user has inside the organization. This factor is critical for a secure, passwordless experience because you’ve coupled one verified user with a verified device to access applications securely. This setup will break any communication from side channels and prevent external scammers and security risks. Additionally, a fluid device-user authentication setup eliminates user friction. Every time the user accesses the application, the authorization is verified back to the device with no or minimal user action. The ROI. In the end, any good decision made by an organization needs to have a positive ROI. Through working with leading analysts, WinMagic now offers an...

What passwordless means for the healthcare sector

What passwordless means for the healthcare sector

WinMagic on Twitter

WinMagic on YouTube

© 2012-2023 SecureSpeak WinMagic Data Security Blog