PHISHING-RESISTANT MFA SUCCESS STORY: USDA'S FIDO IMPLEMENTATION

Summary from the TLDR InfoSec newsletter

The US Department of Agriculture (USDA) primarily uses personal identity verification (PIV) cards for authentication but found that it could not solely rely on PIV cards for situations like when there were temporary employees or for the waiting period before a PIV card can be issued. To solve these issues, users were originally given an exception policy that allowed for username and password login, which was phishing prone. To improve its systems, USDA leveraged a centralized Entra ID system to roll out FIDO MFA using either Windows Hello for Business or FIPS-140 security keys. Leveraging FIDO + SSO allowed the USDA to protect over 600 applications through gradual organizational maturity.