How to leverage biometric identification to upgrade security

Biometric identification is one of the rare security tools that improves protection and convenience at the same time. Here is how we put it to work for clients with Touch ID, Windows Hello, and JumpCloud Go.

Touch ID brought this technology to everyday devices

Apple introduced Touch ID in the iPhone in 2013 — the first use of biometric identification in common, consumer-level devices. In the decade since, fingerprint and facial recognition have added convenient security to nearly every new mobile device and computer. What was once limited to high-security installations and Hollywood movies is now part of our everyday use of technology.

Most cybersecurity measures we recommend trade off between convenience and security: we want data protected, but not so locked down that workflows suffer. Biometric identification is one of the rare tools that increases both at once.

• Your fingerprint and face identify you and you alone — unlike passwords, which can be shared or stolen.
• Presenting your fingerprint or face to your device is quicker, easier, and less prone to data-entry errors than typing a password or passcode.
• Biometrics are highly resistant to fraud and extremely secure. (Unless you're Nicholas Cage in the 1997 action hit Face/Off, the chances of someone stealing your face are quite limited.)

Computers have lagged behind on biometrics

Mobile devices use biometrics for many functions that need extra security — not just unlocking your phone, but logging in to specific apps and making payments. Laptops and computers have lagged behind. They often use Apple's Touch ID and Windows Hello only to unlock the computer and make certain system-level changes. Logging in to your important web-based services is still usually done by password, because your web browser can't tap into the secure biometric identifiers saved to your device.

As we have pushed for clients to enable multi-factor authentication (MFA) for everything under the sun, we've found users suffering from "MFA fatigue" — being asked too many times a day for a password and an additional passcode. That fatigue weakens their acceptance of MFA as a security measure, and the reluctance is itself a vulnerability, because it leads users to resist implementing MFA.

Enter JumpCloud Go

JumpCloud, the service we use most often for our Identity Management service, has taken advantage of its unique position as an authentication provider for devices and services. Its tool, JumpCloud Go, lets users log in to federated services in their web browser using just Touch ID or Windows Hello.

Here is how we set it up:

1. Users and their devices are enrolled in JumpCloud, so local computer login credentials are managed by JumpCloud.
2. Macktez binds organizational services like Google, Microsoft, Zoom, and Dropbox to JumpCloud SSO.
3. Users set up Touch ID or Windows Hello on their computers.
4. Macktez pushes the JumpCloud Go Chrome extension to users' computers.

Now when a user logs in to a bound service — Google, for example — instead of prompting for a password, JumpCloud prompts for biometric verification. Users get a more secure and more convenient way to log in to their most important online services.

Adding device trust

In our implementation of JumpCloud Go, we prefer to add an extra step of security to the initial computer login. That means retrieving an MFA code when you first log in to your computer after a reboot. That step provides another layer of trust for the device, and it lets us have full confidence that bypassing MFA later in favor of device biometric verification is entirely secure.

We rolled out device MFA and JumpCloud Go on Macktez workstations last year, and we've been happy with it. Since then, we've helped a number of existing clients upgrade their security profile and made this a default for new clients. For users suffering from MFA fatigue, JumpCloud Go is a strong tool for tighter compliance and stronger security.