Maintaining ISO 27001 Compliance in a Passwordless World: The Shift to Passkeys

The Shift to Passkeys: Ensuring ISO 27001 Compliance in a Passwordless Era

The transition from traditional password-based security to passkey technology is a transformative journey for organizations. As the use of passkeys continues to gain momentum, with over 15 billion online accounts now supporting this technology, it’s essential for organizations to understand how to implement passkeys while maintaining compliance with ISO 27001 standards.

The Technical Foundations of Passwordless Authentication

Passwordless authentication relies on cryptographic keys, biometrics, or possession-based factors to verify user identities. Passkeys, built on FIDO2 and WebAuthn standards, represent a mature implementation of this approach. When a user creates a passkey, their device generates a cryptographic key pair, consisting of a private key that remains on the device and a public key that’s shared with the server. This approach eliminates the need for passwords, reducing the risk of credential theft and phishing attacks.

ISO 27001 Compliance Requirements

ISO 27001 is a comprehensive standard for information security management, providing a framework for organizations to manage and reduce risks. The 2022 revision of the standard reorganized Annex A controls into four themes: organizational, people, physical, and technological. Authentication falls primarily under three controls: Annex A 5.15 (Access Control), Annex A 5.17 (Authentication Information), and Annex A 8.5 (Secure Authentication).

Mapping Passwordless Adoption to ISO 27001 Controls

To ensure compliance with ISO 27001, organizations must demonstrate that their passkey implementation meets or exceeds existing control objectives. This requires:

• Defining passkey scope by risk level, with device-bound passkeys for privileged accounts and syncable passkeys for standard users
• Documenting fallback procedures for device loss scenarios
• Establishing clear policies for when and how users can authenticate without passkeys during transition periods
• Documenting the complete enrollment process, including identity verification steps and encryption requirements
• Demonstrating multi-factor authentication compliance

Risk Assessment and Treatment

Organizations must also conduct a thorough risk assessment to identify and address potential risks associated with passkey adoption. This includes:

• Eliminated risks: credential theft through phishing, password reuse, brute force attacks, and credential stuffing
• New risks: device loss or theft, vendor lock-in with syncable passkeys, recovery complexity, and downgrade attacks

Benefits of Passkeys

The adoption of passkeys offers several benefits, including:

• Improved security: passkeys eliminate password-based attacks and reduce the risk of credential theft
• Enhanced user experience: passkeys provide faster and more convenient authentication
• Operational efficiency: passkeys reduce the need for password resets and account lockouts

Challenges and Misconceptions

While passkeys offer significant security benefits, there are challenges and misconceptions to consider:

• Passkeys are not completely phishing-proof: attackers can adapt and exploit implementation choices and user behavior
• Account recovery complexity: organizations must establish procedures for recovering lost or stolen devices
• Mixed authentication environments: organizations must navigate the challenges of operating in a mixed environment where some users authenticate with passkeys while others use passwords

Enterprise Implementation Considerations

To ensure a successful transition to passkeys, organizations should:

• Prioritize by risk, starting with privileged accounts
• Maintain defense in depth, combining passkeys with robust session management and device security requirements
• Plan the transition, defining clear migration timelines and tracking user adoption
• Address account recovery proactively, requiring multiple recovery options during enrollment
• Document thoroughly, maintaining records of technical architecture, policy updates, risk assessments, and training materials

About Author

Vaibhav

See author's posts