Overview
With the unrelenting risk of cyberthreats, you’re smart to mandate the use of multi-factor authentication (MFA) for your users logging in to Windows devices. But in the era of zero trust, not all MFA solutions check all the boxes.
The zero-trust model stipulates that no actor, system, network or service operating outside or within the security perimeter is trusted. Instead, we must verify anything and everything attempting to establish access.
This “zero trust, always verify” strategy requires MFA – but not just any MFA.
“Agencies must require their users to use a phishing-resistant method to access agency-hosted accounts. For routine self-service access by agency staff, contractors and partners, agency systems must discontinue support for authentication methods that fail to resist phishing, including protocols that register phone numbers for SMS or voice calls, supply one-time codes, or receive push notifications.”
A Windows login authentication solution that supports zero trust
Only WinMagic’s MagicEndpoint passwordless authentication solution delivers the flexibility, security and ease of use organizations demand – and supports zero trust. MagicEndpoint rachets up security several notches by performing ultra-secure, seamless public key-based authentication at the endpoint – all in a single step, with no user action required.
MagicEndpoint makes MFA Windows login better because:
- Its unbreakable public key-based authentication is magnitudes stronger than anything the user can do.
- It works in conjunction with smartphones, tokens, smartcards, TPM or biometrics.
- It supports zero trust because the endpoint performs continuous verification.
- It supports VDI and RDP Windows login with no user action.
- It can further strengthen security by performing pre-boot authentication, as well as Windows login.
- Its one-step process ensures a faster, more seamless user experience.
- It makes IT management easier.
How MagicEndpoint Works with Windows Login
MagicEndpoint is designed to support seamless user authentication from start to finish. Organizations with full-disk encryption have the option of ensuring maximum protection by setting up MagicEndpoint to perform pre-boot user authentication upon startup. MagicEndpoint takes advantage of the existing Trusted Platform Module (TPM) crypto chip within the endpoint to provide unbreakable public key-based authentication.
Next, the endpoint authenticates to the Windows server using public key-based encryption on behalf of the user and device, with no user action required. The user then logs in to Windows – with no further steps required – working in concert with all of the following technologies:
- Bluetooth-connected phone-based token (passwordless)
- PIV/tokens
- TPM with local PIN
- MFA with smartphone
(push notification) - Device biometrics
(Windows login only) - AD password
With MagicEndpoint, the endpoint can verify not only the user’s presence but also the user’s intent to access the service. This is unlike out-of-band methods, such as push authentication, in which the user is relied upon to explicitly make the association of intent. Local gestures, such as pressing a button or even submitting to a facial recognition scan, don’t communicate the user’s exact intention to the remote server, but MagicEndpoint does.
