Passwordless Authentication in Education
The Need for Passwordless, Two-Factor Authentication in Education
“Hackers don’t break in—they log in.” - Microsoft Chief Information Security Officer Bret Arsenault
Securing the accounts of teaching and non-teaching staff and administrators presents its own set of unique challenges. If 2FA is enabled are staff required to use their personal cell phone? Will administrators have dedicated devices? Will the board invest in security keys for staff? What about students? How can school boards implement passwordless authentication for students when they don’t have cell phones, devices with biometric recognition or security keys?
We know passwordless authentication is the future. In May of this year, Google, Microsoft and Apple, along with the FIDO alliance, announced that users could begin to use passkeys, as an additional option to using passwords and 2FA, to access their accounts, apps and supported websites. If there was any question of where Google stands on the topic, the title of their blog post The Beginning of the End of The Password, makes it abundantly clear.
Passwordless authentication is more secure and creates a better user experience than entering a username and password. This is something of critical importance to the education industry. According to the 2023 Canadian Cyber Security Study published by CDW, across all industries and organization size, the highest hit rate for successful cyberattacks were in Education and Government at 10%. Education contains many unique challenges and obstacles to overcome in regards to cybersecurity. Firstly, the size of the attack surface combined with limited budgeting resources make defending against cyber attacks increasingly difficult for school boards. Secondly, the age and ability of students presents many challenges in implementing passwordless or complex password policies. The most common attack vector is weak or compromised credentials (Fortinet) yet many of the boards we speak to share the same concern. Their FGPPs for K-3 students and in some cases all elementary students contain no complexity. It makes sense of course. Trying to get a classroom of 6 year olds to sign in with a 12 or more character complex password would be unrealistic, but the fact remains. Student accounts, and specifically the accounts of younger students present a security liability for school boards.
Password policies for school board staff present many challenges as well including password fatigue, calls to the IT Help Desk and phishing attacks. Each of these are pushing IT Departments to find a better solution.
But: what options are available to school boards who want to go passwordless? The IT administrators that we speak to are looking for simple and secure login options for their students, but also their teaching and non-teaching staff, administrators and senior administrator teams. The challenge however, is that creating a plan towards passwordless authentication in education is not a one size fits all approach.
With school boards grappling with the best approach to take, we outline some of the current options available, their potential usage in the education industry and some of the pros and cons associated with each.
Cloudwise COOL Easy Login
| Pre-Requisites, Systems and Devices |
|
| User Experience | |
| Usage Group |
|
| Pros/Cons | Pros:
Cons:
|
Microsoft Authenticator App
| Pre-Requisites, Systems and Devices |
|
| User Experience |
|
| Usage Group |
|
| Pros/Cons | Pros:
Cons:
|
Choosing a Passwordless Method
FIDO2 Security Key
| Pre-Requisites, Systems and Devices |
|
| User Experience |
|
| Usage Group |
|
| Pros/Cons | Pros:
Cons:
|
Windows Hello
| Pre-Requisites, Systems and Devices |
|
| User Experience |
|
| Usage Group |
|
| Pros/Cons | Pros:
Cons:
|
Google Passkeys
| Pre-Requisites, Systems and Devices |
|
| User Experience |
|
| Usage Group |
|
| Pros/Cons | Pros:
Cons:
|
- Communities
- Cyber Security and Risk Management
- IT Modernization and Cloud
- Region
-
Canada
Published by
Most Popular
