Five Practices for More Secure Identity Verification
Summary
A sponsored guide recommends phishing-resistant MFA, stronger service-desk identity checks, device-trust signals, passkeys, and safeguards for biometric data to strengthen identity verification.
Key points
- Prefer phishing-resistant MFA, such as FIDO2 security keys, passkeys, or certificate-based authentication, over SMS or email codes.
- Require trusted identity verification before helpdesk staff reset passwords, change MFA, or complete other sensitive actions.
- Use device management, patch status, endpoint protection, certificates, and session integrity as signals in access decisions.
- Passkeys use public-key cryptography and can reduce exposure to phishing and credential theft; retain strong fallback controls for recovery and device changes.
- Avoid storing raw biometric data where possible; use encrypted templates and local authentication when feasible.
Article Details
- Defense Focus
- Strengthen identity verification and access controls against credential theft, impersonation, and weaknesses in authentication and service-desk workflows.
- Detection Methods
- Evaluate device trust signals alongside credentials and trigger step-up authentication, restrict access, or block sessions for unmanaged devices or suspicious IP ranges.
- Verify user identity through trusted authentication methods before service-desk password resets, MFA changes, or other sensitive actions.
- Assess device compliance and signs of compromise as part of authentication decisions.
- Data Sources
- Device management status
- Operating system version and patch status
- Endpoint protection or EDR presence
- Device certificates or cryptographic identifiers
- Browser reputation and session integrity
- Indicators of compromise, malware, rooting, or jailbreaking
- Login source, including corporate network or suspicious IP range
- Platforms
- Identity verification and authentication systems
- Service-desk and helpdesk workflows
- Endpoint protection and EDR systems
- Defensive Actions
- Prefer phishing-resistant MFA, including FIDO2 security keys, passkeys, or certificate-based authentication.
- Move away from SMS- or email-based one-time passcodes; where appropriate, prefer authenticator apps that generate local OTPs over push approvals.
- Require identity verification before sensitive service-desk actions and strengthen procedures against employee impersonation and social engineering.
- Incorporate device trust and compliance into access decisions, with step-up authentication, restricted access, or session blocking when signals are suspicious.
- Use passkeys where appropriate and maintain strong password and phishing-resistant MFA controls for fallback and account recovery.
- Avoid storing raw biometric data where possible; use encrypted biometric templates and local authentication on trusted devices where feasible.
MITRE ATT&CK
T1111 · Multi-Factor Authentication InterceptionThe article identifies SIM swapping as an attack that can exploit weaker MFA implementations.T1539 · Steal Web Session CookieThe article states that attackers steal session cookies to interfere with authentication and make compromised accounts harder to distinguish.T1621 · Multi-Factor Authentication Request GenerationThe article identifies prompt bombing as an attack that can exploit weaker MFA implementations.T1656 · ImpersonationThe article describes attackers impersonating employees to persuade service-desk staff to provide account access, typically through reset requests.
Vendors
Products
Specops Secure Service DeskSpecialized solutions like Specops Secure Service Desk embeds secure identity verification directly into helpdesk workflows, requiring users to verify their identity through trusted authentication methods beforeSpecops Verified IDFor especially high-risk actions at the service desk, Specops Verified ID adds government document scanning and biometric liveness detection to identity verification workflows.