FIDO Alliance Praises OMB’s New Federal MFA Initiative

The FIDO Alliance is applauding the new Federal Zero Trust Strategy being laid out by the US Office of Management and Budget (OMB). The OMB released the final version of the strategy on January 26, and has stated that federal agencies have until the end of 2024 to comply with the initiative.

The OMB strategy is part of a broader shift to Multi-Factor Authentication (MFA) at the federal level. President Joe Biden issued an executive order last May that gave federal agencies 180 days to implement MFA, in a move that similarly received praise from the FIDO Alliance.

The new arrangement, meanwhile, states that federal employees will need to use MFA to access any accounts that are hosted by a federal agency. That requirement will still be in place even in situations where employees cannot use Personal Identity Verification (PIV) options. The FIDO Alliance noted that FIDO security keys are a valid alternative in those situations, and that such solutions can be deployed at scale relatively quickly.

According to the Alliance, the OMB directive is designed to mitigate the threat of phishing. The OMB has stated that agencies should avoid the use of one-time passwords and other secondary authenticators that can be intercepted.

“The Federal Zero Trust Strategy provides a robust roadmap for agencies to follow to ensure best practices in creating a zero trust environment,” said FIDO Alliance Executive Director Andrew Shikiar. “The FIDO Alliance commends the Office of Management and Budget for requiring phishing-resistant authentication to protect agencies as phishing attacks become significantly more sophisticated – including the increasingly common ability to bypass legacy MFA approaches such as OTPs.”

Biden’s executive order was a response to several high-profile data breaches in the past few years. That included the SolarWinds breach and the Colonial Pipeline ransomware attack, both of which underscored the limited utility of passwords. In that regard, the FIDO Alliance has consistently advocated for the use of passwordless authentication options.