Microsoft Authenticator for iOS Now Complies with FIPS 140 Standard -- Redmondmag.com

Microsoft Authenticator for iOS Now Complies with FIPS 140 Standard

By Kurt Mackie
12/08/2022

The Microsoft Authenticator app for iOS devices is now compliant with the U.S. government's "Federal Information Processing Standards (FIPS) 140" security standard, according to a Thursday Microsoft announcement.

FIPS 140 compliance is currently available when using Microsoft Authenticator "version 6.6.8 and higher" on iOS devices. Microsoft described the compliance in terms of Azure Active Directory product interactivity, as follows:

Authenticator version 6.6.8 and higher on iOS is FIPS 140 compliant for all Azure Active Directory (Azure AD) authentications using push multifactor authentications (MFA), Passwordless Phone Sign-In (PSI), and time-based one-time passcodes (TOTP).

Microsoft Authenticator is FIPS 140 compliant for iOS devices, but Microsoft stopped short of saying that it was certified. Being FIPS 140 compliant means that Authenticator relies on FIPS 140-validated products for its cryptographic functioning, according to this Microsoft "Overview" document on FIPS 140-2. The term "validated," on the other hand, gets used when products have been certified by the Cryptographic Module Validation Program, overseen by the U.S. National Institute of Standards and Technology and the Canadian Centre for Cyber Security.

Specifically, Microsoft Authenticator uses Apple's cryptography to "achieve FIPS 140, Security Level 1 compliance on Apple iOS devices," Microsoft's announcement explained.

Microsoft suggested that Authenticator's FIPs 140 compliance would help federal agencies that are carrying out the "requirements of the Biden administration's Executive Order (EO) 14028, 'Improving the Nation's Cybersecurity,'" as well as healthcare organizations working with the Electronic Prescriptions for Controlled Substances (EPCS) rule concerning electronic prescriptions.

Microsoft is next working to assure FIPS 140 compliance for Authenticator on Android devices, which will be "coming soon."

At a larger level, Microsoft is now one of four cloud services contractors vying for Pentagon dollars. The U.S. Department of Defense's $9 billion Joint Warfighting Cloud Capability program, formerly called the Joint Enterprise Defense Infrastructure (JEDI) program, is getting contracted out to Alphabet (Google's parent company), Amazon Web Services, Oracle and Microsoft, according to a Dec. 7 Reuters story.

Microsoft outlined all of its assets to deliver an "enterprise-level tactical cloud" to U.S. military agencies in this Dec. 8 announcement.

"With comprehensive infrastructure and data management solutions like Azure Arc, Microsoft Purview and Defender for Cloud, Microsoft will be a key partner to the DoD as they navigate the multi-cloud environment and ensure seamless interoperability of systems and services," the announcement indicated.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.