Passkeys in light of DORA and NIS2 regulations

Passkeys for banking in the EU

EU Legal Framework for Strong Authentication in Cyber Security.

In recent years, the European Union has adopted cybersecurity regulations to strengthen data protection and safeguards in the digital world. One of the critical pieces of legislation in this regard is the GDPR (General Data Protection Regulation), which, while focusing mainly on data privacy, includes provisions on the security of information processing. However, it is the DORA (Digital Operational Resilience Act) Regulation and the NIS 2 (Network and Information Security Directive) that point more directly to the need to implement strong authentication mechanisms, such as multi-factor authentication (MFA). These regulations emphasize that financial institutions and providers of key digital services must employ advanced protection measures to ensure data integrity and confidentiality. This raises the question: Are traditional MFA methods such as TOTP or SMS strong enough, or are modern solutions such as passkeys, offered by the FIDO Alliance, a better alternative in light of these requirements?

Passkeys and the EU Legal Framework for Strong Authentication in Cybersecurity

Strong Authentication and FIDO Initiatives in the Context of the EU Guidelines.

Strong authentication, often referred to as Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA), refers to the process of verifying a user’s identity through a combination of two or more independent components: something the user knows (e.g., a password), something the user has (e.g., a token or smartphone) and something the user is (e.g., biometrics like a fingerprint or facial recognition). Unlike traditional password-only authentication methods, MFA and 2FA provide a much higher level of security, minimizing the risk of unauthorized access to systems and data.

The FIDO Alliance, or Fast IDentity Online Alliance, is an industry consortium that seeks to create open authentication standards to increase online security and reduce reliance on passwords. FIDO authentication is based on local user verification, which means that sensitive credentials never leave the user’s device, making it immune to phishing or data interception attacks.

The European Union is emphasizing strong authentication for several reasons. First, the number of cyber security incidents, including data breaches and phishing attacks, is growing at an alarming rate, posing a serious threat to citizens’ privacy and the region’s economic stability. Second, as digital transformation continues, security is becoming a key element in building trust in digital services and technologies. By promoting strong authentication, the EU aims to create a more secure and trusted digital environment for all its citizens and businesses.

Passkeys The Direction Shown by Financial Giants

Passkeys: A Revolution in the Direction of True Passwordless

Passkeys, as highlighted by the FIDO Alliance, represent a breakthrough in authentication, moving us from traditional password-based systems toward a complete passwordless solution. Unlike traditional passwords, which rely on what the user knows, passkeys rely on local authentication, where user verification occurs on the device. This approach brings us closer to the real world without passwords, eliminating the need for expensive physical security keys while offering an equally high level of protection.

Technology giants such as Apple, Microsoft, and Google have already begun introducing passkeys technology, a testament to its potential and future in the digital world. As more and more companies and organizations adopt passkeys, we are witnessing not so much a violent revolution but rather a subtle evolution in how we approach authentication. Analogous to the evolution of the wallet we once carried in our pockets and now store digitally on our smartphones, passkeys are transforming our approach to security. In the not-too-distant future, we will realize that we no longer use traditional passwords. Instead, all of our access keys, cryptographically secured, will be stored on our devices thanks to passkeys technology, providing us with ease of access and unparalleled security.

Passkeys - Quick & Easy Guide to Passwordless Authentication

Adoption of Passkeys: Direction Pointed by Financial Giants

Since passkeys’ technology was introduced to the market, its adoption has proceeded at a fast pace, especially in the financial sector. Institutions such as Robinhood, Money Forward ID, Binance, and Boursorama have already successfully implemented passkeys, highlighting their advanced approach to security and innovation.

Moreover, in light of a recent survey conducted by 1Password, it has become clear that the Internet community has specific expectations about which companies should next adopt passkeys technology. Payment giants such as VISA and Mastercard and modern banking platforms like Revolut have been identified as those that users say should implement passkeys as soon as possible. In addition, the list included more than 250 other financial companies that Internet users considered key in the context of the technology.

Such a trend indicates one thing: passkeys are no longer just a technological novelty but are becoming a standard that customers expect. As more and more financial institutions see the benefits of passkeys, we can expect this technology to become an integral part of the future of digital banking.

Passkeys in 7 days with Secfense

Holistic Protection with Passkeys: The Key to Comprehensive Adoption

Today’s banking customer uses multiple channels of communication and interaction with the financial institution – from an online account to mobile apps to talking to a consultant or visiting a branch. That’s why it’s crucial that authentication technology like passkeys be consistently deployed at all these points of contact. As a result, customers experience consistency, security, and convenience at every stage of their interaction with the bank.

Secfense specializes in the easy and fast adoption of passkeys technology. Its unique approach allows the implementation of this technology in any application or system without interfering with the code. This allows organizations to secure their entire infrastructure and by extension, all users – both employees and customers. The result is total immunity from phishing attacks, which is invaluable nowadays.

Adopting passkeys from Secfense is not only express but also intuitive. It enables codeless implementation for the organization and easy and intuitive adoption by the end user. If you want to convince yourself of the effectiveness of this technology, we invite you to participate in “Proof of Value” tests. Under this program, you will receive complete MFA protection for one of your applications, all users will use the MFA of your choice, and you will gain an additional layer of protection in the form of micro-authorization, full site protection (VPN functionality without the need to purchase a VPN) and a passwordless transformation checklist.

Antoni takes care of all the marketing content that comes from Secfense. Read More

Testimonials

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures

Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.

Dariusz Pitala

Head of IT

MPEC S.A.