5 reasons why the government and other public sector agencies should care about WebAuthn

July 23, 2020 4 minute read

Federal, state and local governments and other public sector agencies have important responsibilities that support a functioning community – everything from national security to public transit, public education, public safety, state parks, financial services, energy and power grids, and many more services are all tax funded and managed by the public sector. While these are vital components to life as we know it, the sheer amount of personal and sensitive information required to uphold these critical operations puts agencies at constant risk of being compromised.

Government and other public sector run systems and data are accessed daily not only by employees and contractors, but also by partners and citizens, exponentially increasing the likelihood of security breaches related to account takeovers. In fact, remote hacks continue to occur at an alarming rate, while also growing more advanced. According to the 2020 Verizon Data Breach Report, organized criminal groups were behind 55% of breaches, and nation-state or state-affiliated actors were behind 38% of breaches.

While CAC and PIV cards are de-facto authentication methods across various Federal agencies within the public sector, there are many cases where they’re not suitable, and passwords do not provide enough security to defend against the volume of sophisticated attacks. Fortunately, WebAuthn, a core component of the FIDO Alliance’s FIDO2 set of specifications, is a modern, phishing-resistant web authentication standard that is now supported across all computing platforms. WebAuthn makes it easy for websites, services, and applications to offer strong authentication with the option of removing the reliance on passwords entirely. This could include government hosted web-based applications and services – like the Department of Motor Vehicles –  that are both employee and customer facing.

Here are 5 reasons why the Federal government and other public sector agencies should care about WebAuthn:

Standardized strong authentication 

For the first time, the standardization of strong authentication is possible. Imagine setting up simple multi-factor authentication (MFA) across digital public sector services and having a convenient, consistent, and secure login. WebAuthn enables just that across all major browsers and operating systems, empowering services and apps to make strong authentication available to end users.

Improved security 

The public sector has access to critical information and stores sensitive data, meaning a breach could impose on the safety and security of millions of constituents. With the help of public key cryptography, WebAuthn raises the bar for strong authentication and provides strong MFA security for users, including public sector employees, contractors, partners and citizens.

Seamless user experience 

Through a WebAuth API, strong authentication is accessible for web and mobile apps, eliminating the hassle of password resets and SMS codes, allowing users the convenience to sign in by tapping a security key. The WebAuthn API enables IT teams and developers to easily and quickly integrate WebAuthn into existing and new services, providing a consistent and seamless authentication experience for their users.

WebAuthn also gives users a broad range of choices for authenticating, from biometrics to hardware security keys.

Improved productivity 

Resetting passwords is no longer an issue with WebAuthn. With the possibility of passwordless login, it eliminates the time spent and frustrations that stem from managing passwords. This time saved extends to help desks and support centers – for both internal public sector employees and external users – who no longer have to devote resources to resetting and maintaining passwords.

Reduced costs 

Breaches, especially for government and other public sector entities, can be detrimental in many ways, including confidential data loss, lost productivity and financial burdens. WebAuthn helps reduce negative financial impacts associated with breaches and support costs, allowing government and other public sector services to repurpose budget that was previously designated to maintain and manage infrastructure and passwords.

Interested in learning more about the benefits of WebAuthn in the public sector? Download the Yubico white paper series, WebAuthn for the Public Sector, here .  Additionally, you can view Yubico’s on-demand webinar on the topic here

Share this article:

Recommended content


Put Your Finger on the Pulse of What’s New with the YubiKey Bio Series

Today, we are announcing the YubiKey Bio Series, Yubico’s first-ever YubiKeys supporting biometric authentication. The YubiKey Bio was first previewed at Microsoft Ignite in 2019 where we showed a live demo of passwordless sign-in to Microsoft Azure Active Directory accounts. We’ve taken the time to ensure that we are launching products that are highly secure ...


Zero Trust is the new regulatory minimum for Federal agencies: what does that mean for authentication?

The deadline is looming for federal agencies to implement impersonation-resistant multi-factor authentication (MFA), just one of the new stronger security requirements under President Biden’s new cybersecurity executive order (EO 14028). The EO puts security front and center to address some of the worst cyber attacks against the federal government, setting up new federal compliance expectations ...


Everything you need to know about the revised eIDAS regulation

In June 2021, the EU Commission announced its plans for a revised eIDAS regulation. eIDAS (electronic IDentification, Authentication and trust Services) is the EU regulation 910/2014 on electronic identification and trust services in the EU. It came into force in 2014, so the revision is a major update to eIDAS. The past two years the ...


Top five pitfalls companies should avoid when rolling out a passwordless strategy

Given the number of breaches in the news today where passwords were at the root of the problem, many companies are now exploring the benefits of a secure passwordless future. Secure passwordless logins not only bring cost efficiencies and a more frictionless user login experience into the organization, but deliver the security that is necessary ...