FIDO RSAC Presentations

1. © 2022 OTIS ELEVATOR COMPANY.
Our Journey to Passwordless:
Secure Authentication & Frictionless User
Experience
Darrell Hawkins
Cybersecurity Chief Technology Officer

2. © 2022 OTIS ELEVATOR COMPANY.
© 2022 OTIS ELEVATOR COMPANY.

3. © 2022 OTIS ELEVATOR COMPANY.
Today’s Agenda…
• Key initiatives
• Our migration to passwordless MFA
• Learnings & Tips
• Results
© 2022 OTIS ELEVATOR COMPANY.

4. © 2022 OTIS ELEVATOR COMPANY.
Key
Initiatives
• Digital Transformation
• Seamless Onboarding
• “Access for All”
• Forward Compatibility
© 2022 OTIS ELEVATOR COMPANY.

5. © 2022 OTIS ELEVATOR COMPANY.
OTIS PROPRIETARY AND CONFIDENTIAL. 5
The Challenges Drove The Journey
A. Indirect worker onboarding required
physically being in a local office
B. Direct workers could only get into the
HR tools with a local login which was
frequently forgotten
C. Security push to replace the logon on
laptops/workstations with
Passwordless authentication

6. © 2022 OTIS ELEVATOR COMPANY.
A: The
Onboarding
challenge
Infrastructure was stood up for basic Passwordless Authentication
Pandemic greatly increased the volume of people needing
access before VPN was established
The HelpDesk needed to generate the magic link for the new-hire
so they could VPN into the Network
The tool didn’t yet have a role to generate one, so we integrated our IGA
solution with the Passwordless solution using the API provided
This enables us to provision that admin level to the HelpDesk and the direct
supervisor
Onboarding & connection went from 3 days to 30 minutes

7. © 2022 OTIS ELEVATOR COMPANY.
B: Direct
worker
challenge
HR Platform could only talk to 1 Identity Provider. We had 4 Azure
tenants to feed into it
Using our IGA and IDP solutions to round out the architecture we merged
the information and tied it to our Passwordless solution
Each country had different “Why’s” to encourage registration and usage
Partnered with the Business and HR to provide successful support
with a small team
Provided access for all to the HR platform and the desktop using their
phone to authenticate. No password needed
Created synthetic identities for those without e-mail addresses

8. © 2022 OTIS ELEVATOR COMPANY.
C: Security
Roadmap
Transition to new internal Certificate Authority 4-6 months
Once certificates are pushed to all machines the MFA integration
begins
Passwordless Authentication to workstations complete
Continue integration of applications to SSO so complete
passwordless is achieved

9. © 2022 OTIS ELEVATOR COMPANY.
Overcoming Initial Resistance
© 2022OTIS ELEVATOR COMPANY.
“I do not want to have yet another
authentication mechanism that I have to
manage/use”
“I love that I can log in from my work or personal device
without having to remember a password. I only need my
face or my thumb print, it’s so easy!”
- Sr. Director HR Operations
“I do not always have cell access / I do not want
to use my phone”
Answer: FIDO2 keys come in many different forms,
some do not require a cell phone. Offline access is also
available
- Identity Team
“This sounds like there is going to be a big, time-
consuming thing. I have a day job!” “I’m so embarrassed that I waited so long to
register, it was quicker than brushing my teeth.”
- Branch Manager
“I do not like my personal data and biometrics
floating out there”
Answer: The only information about you stays on
the secure enclave of your phone
- Identity Team

10. © 2022 OTIS ELEVATOR COMPANY.
Addressing Cultural Barriers and
other issues
© 2022 OTIS ELEVATOR COMPANY.

11. © 2022 OTIS ELEVATOR COMPANY.
© 2022 OTIS ELEVATOR COMPANY.
Transformed onboarding & password reset process
Streamlined how employees interact with services
Thoroughly addressed geo and cultural requirements
Next level security assurance combined with excellent UX
Benefits

12. © 2022 OTIS ELEVATOR COMPANY.
Results
Rapid
Onboarding
Passwordless
Access
Uncompromising
Security Strategy
© 2022 OTIS ELEVATOR COMPANY.

13. © 2022 OTIS ELEVATOR COMPANY.
13