Passwordless Authenticationin Public Sector Organizations
Passkeys, SSO and Biometrics

PubSec - PasswordlessWhat is Passwordless
Authentication?
By eliminating the need for users to remember andinput passwords, passwordless authentication aims
to enhance both security and the user experience reducing vulnerabilities associated with weak or reused
passwords, and streamlining the login process.
Passwordless authentication is a security methodthat allows a user to gain access to a system without
entering a traditional password. Instead, it relies onalternative means of verification such as biometricdata (like fingerprints or facial recognition), hardware
tokens or one-time codes sent to a trusted device.

By integrating with Keeper Security
Government Cloud (KSGC) with
Single Sign-On (SSO) and biometricsolutions, public sector organizations
can easily and cost-effectively
achieve a fully passwordlessexperience for their employees.

Because of these benefits, passwordlessauthentication initiatives have become a top priority
for government organizations of all sizes. However,many teams are wary of moving away from legacy
systems due to perceived cost and user adoption
barriers.
By integrating Keeper Security Government Cloud withsingle sign-on and biometric solutions, organizations
can easily and cost-effectively achieve a fully
passwordless experience for their employees.
•	Keeper provides a secure digital vault that stores,manages and autofills passwords and passkeys.
•	Keeper integrates with SSO providers, enablingusers to access their vault records via SSO, insteadof having to enter a master password.
•	Keeper integrates with passwordless providers,enabling users to access their vaults without the useof a master password.
Your employees authenticate into their Single Sign-On(SSO) via biometrics (such as face scan or fingerprint).
SSO allows them to access the major systems that theyneed. For any applications and websites that are notcovered by SSO, KSGC will store, manage and autofill
passkeys for authentication. This process is seamlessand secure and does not require users to enter
passwords.

© 2023 Keeper Security, Inc.

2

PubSec - Passwordless

Understanding the Threat
A recent report highlights significant vulnerabilities
in the password security measures of the U.S.
Department of the Interior (DOI). The primaryobjective of the inspection was to determine theeffectiveness of the Department’s password
management and enforcement controls in preventing
unauthorized access by malicious actors.
The findings revealed that the Department’s
password complexity requirements and management
practices were insufficient in preventing potential
unauthorized access. Specifically, 21% of active user
passwords, including those of senior U.S. government
employees and accounts with elevated privileges,
were cracked. The Department did not consistently
implement Multi-Factor Authentication (MFA),leaving 89% of its high value assets vulnerable.
Furthermore, password complexity requirements
within the organization were outdated, allowing users
to choose easily cracked passwords. For instance,
4.75% of all active user account passwords were basedon the word “password.” The report also found thatthe Department did not promptly disable inactive
accounts or enforce password age limits, leaving over
6,000 accounts vulnerable to attacks.
Password security is a significant challenge forpublic sector organizations due to the potential
risks associated with unauthorized access. Proper
identification and authentication of users arefundamental security controls for granting access toorganizational systems. Passwords and credentials,
being a primary target for malicious actors, playa crucial role in this process. If a cybercriminal or
malicious insider compromises an account withelevated privileges, the potential harm is magnified as
the attacker can upload malware, steal sensitive data,alter system configurations and change logs to hide
their actions.
This report highlights vulnerabilities at a well-funded
and highly technical federal agency, but these samechallenges are mirrored, if not multiplied, at smaller
and less-funded government organizations.

Source: P@s$w0rds at the U.S. Department of the Interior: Easily Cracked Passwords,
Lack of Multifactor Authentication, and Other Failures Put Critical DOI Systems at Risk

© 2023 Keeper Security, Inc.

3

PubSec - Passwordless

Password Risks Greater at Small Government
Agencies and Organizations
Managing employee access and enforcing password
security best practices in state, local and higher
education agencies presents unique challenges,
especially when compared to well-funded federal
agencies. These challenges are accentuated by limited
budgets, diverse user populations and the need tobalance security with usability.
One of the primary challenges is the sheer diversityof users in such institutions. For instance, a university
might have a mix of students, faculty, administrative
staff and temporary or contract workers, eachrequiring different levels of access to various systems.
Managing and regularly updating these accessprivileges can be a daunting task, especially when
IT resources are limited. Without a robust Privileged
Access Management (PAM) system in place, there’s arisk of granting excessive permissions, which can leadto security breaches.

Enforcing password security best practices is anothersignificant challenge. While strong, unique passwords
are essential for security, they can be hard for users
to remember, leading to unsafe practices like writing
passwords down or using the same password acrossmultiple systems. Furthermore, regular password
changes– while often recommended for security
reasons– can lead to increased helpdesk tickets
for password resets and strain already limited ITresources.
Providing a secure environment without adding friction
to users’ daily workflows is a delicate balance to strike.
Implementing MFA, for example, greatly enhances
security. However, if not seamlessly integrated, it canbe seen as an inconvenience that leads to resistancefrom users. Similarly, while restricting access tocertain websites or applications might protect against
potential threats, it can also hinder productivity if
employees can’t access the tools they need for theirwork.

© 2023 Keeper Security, Inc.

4

PubSec - PasswordlessAn Ideal Solution From Passwords toPasswordless
Passwords are often the only security measureprotecting government agencies and assets,
especially on the state and municipal level.
Most states dedicate less than 3% of their IT
budgets to cybersecurity, as opposed to morethan 10% in the private sector. Nearly half ofall U.S. states lack a dedicated cybersecurity
budget line item.
Many organizations are looking to get rid of passwords
all together, replacing them with passwordlessauthentication. Passwordless authentication is amethod of verifying your identity without a password.
The end goals for a secure login are to determinethat you are who you say you are, and that you arepermitted to access the resource you are attempting toaccess. Passwordless authentication can achieve thesegoals by identifying a user with multiple factors, suchas biometrics and device ownership, without having to
fumble with passwords.
A typical password-based MFA or Two-Factor
Authentication (2FA) login experience requires a user toenter a password followed by a second authentication
factor, commonly in the form of a one-time code sent
through SMS or an authenticator application. In thisscenario, the password is the first factor and the onetime code is the second factor.
Passwordless authentication is a multifactor
authentication system that doesn’t require users
to enter a password. Instead, a passwordlessimplementation uses other authentication factors.
These can include your mobile device, an authenticator
application on the device, and a process where anauthenticating system establishes a cryptographic pairwith the authenticator application on a user device toverify identity.

The Benefits of Passwordless
Authentication

Provides unphishable security byeliminating passwords

Prevents breaches from weak andreused passwords

Replaces knowledge factors
with more secure biometric andpossession factors

Reduce password-related
IT support costs

Provides frictionless login
experience

Increases productivity© 2023 Keeper Security, Inc.

5

PubSec - PasswordlessWhat Is a Passkey?

Passkeys are another type of passwordlessauthentication that is growing in popularity andadoption. In its simplest form, a passkey is a
cryptographic key that lets you log in to accounts
and apps without having to enter a password. Thinkof it as a digital version of a keycard that’s stored onyour phone, tablet or computer. A passkey leverages
biometrics on your device, such as your fingerprint orfacial recognition. Passkeys make it possible for you tolog in to supported apps and accounts the same way
you unlock your phone or tablet with your fingerprint
or face.

Passkeys only work on websites and applications
that support them. They have to be enabled in theaccount’s security settings in order for the user to beable to log in with them. Google, Apple, Microsoft,Amazon, Best Buy, GoDaddy, PayPal, Kayak andeBay are among the major companies that support
passkeys right now.

Passkeys are made up of a public key and a private
key, both of which are required for you to log in to anaccount. The public key is stored with the company
you have the account with and the private key isstored locally on your device. Together, these keys
authenticate who you are.
When you go to log in to an account that has passkeys
enabled, the account server sends a “challenge”
to the authenticator, which can be a phone, tablet,computer, web browser or password manager. Theauthenticator then uses the private key it has stored tosolve the challenge and sends a response back. This isalso known as “signing” the data, which confirms yourownership of the private key, verifies your identity andenables you to log in to your account without having toenter a password. The private key is never revealed in
the login process.

Google recently announced that not
only does it support passkeys for all
personal accounts across its billions
of users, but it is going a step furtherand will make passkeys the default
login setting for users.

© 2023 Keeper Security, Inc.

6

PubSec - Passwordless

Creating a Fully Passwordless Experience with Passkeys,
SSO and Biometrics
When you use a password manager while creating a passkey, the password manager handles the passkey creation
request so it can be saved to your vault. Once a passkey is stored in your password vault, you can access and use
it across multiple devices, browsers and Operating Systems (OS), meaning you’re not limited to logging in to an
account with a passkey from a single device. An added benefit to using a password manager to store your passkeys
is that you can also share it with other users, just like any other record in your vault.

While passkeys may eventually replace passwords, they won’t replace password managers.
Instead, password managers will become even more important. This is because passkeys are tied
to an authenticator. Users have a choice as to whether to use a device – usually a smartphone, but
a tablet, laptop or desktop could work – or a password manager that supports passkeys.
At first, using a smartphone as an authenticator may seem like the logical option, as most people have their phones
with them all the time. However, since most people use multiple devices, this quickly becomes inconvenient. If a user
wants to access an account or app on a different device, like their laptop or tablet, they would have to generate a
QR code on that device, scan it with their authenticator, then use their biometrics to finally sign in.

© 2023 Keeper Security, Inc.

7

PubSec - Passwordless

Keeper Security Government Cloud
Keeper Security Government Cloud is a FedRAMP Authorized password manager and privileged accessmanager. KSGC equips organizational IT administrators with visibility and control over password and passkey
security practices across the entire organization, on all devices, and enables IT admins to enhance authentication
security.
Integrating passwordless authentication into KSGC provides the ultimate frictionless login experience for users.

Keeper SSO Connect
KSGC offers seamless integration with popular single sign-on solutions, such as Okta, AWS, OneLogin, Ping
Identity, F5 BIG-IP APM, Google Workspace, JumpCloud and Microsoft ADFS / Azure AD to provide businesses theutmost in authentication flexibility. Keeper SSO Connect is a patented technology which allows you to quickly andsecurely integrate zero-knowledge password management and encryption with your existing SSO solution using
standard SAML 2.0 (Security Assertion Markup Language) authentication.
Keeper SSO Connect provides secure authentication and end-to-end encryption across all of your websites,
systems and applications without the need to remember a master password. Keeper is compatible with Conditional
Access Policies (CAP) enforced by the identity provider, including any existing MFA solution.

If your identity provider supports passwordless login, users canchoose between any available passwordless options including:

Biometric authentication

FIDO2 security keys

Passkeys

One-time passwords(OTP)

Magic links

Rules engines based onstate of systems© 2023 Keeper Security, Inc.

8PubSec - PasswordlessIntegrating Keeper With Passwordless Systems
Keeper connects SSO, IdP and passwordless solutions with passkey management to provide a seamless and securelogin experience.
Keeper SSO Connect is a patented solution that enables users to integrate Keeper’s password and passkey
management capabilities with any SSO vendor using standard SAML 2.0 authentication.
Keeper SSO Connect also integrates with all popular passwordless platforms that support SAML 2.0 including
Trusona, Veridium, HYPR, Secret Double Octopus, Traitware, Beyond Identity and PureID.
By combining passkey management with SSO, biometrics or both, organizations can achieve full coverage, security
and control across every application and website without end users ever needing to enter a password.

keepersecurity.com | sales@keepersecurity.com© 2022 Keeper Security, Inc.
9© 2023 Keeper Security,9Inc.