Multifactor authentication (MFA) is a security system that requires more than one method of authentication from independent categories of credentials to verify the user’s identity for a login or other transaction.
Multifactor authentication combines two or more independent credentials: what the user knows (password), what the user has (security token), and what the user is (biometric verification). The goal of MFA is to create a layered defense to make it more difficult for an unauthorized person to access a target such as a physical location, computing device, network or database. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target.
Typical MFA scenarios include:
- Swiping a card and entering a PIN.
- Logging into a website and being requested to enter an additional one-time password (OTP) that the website’s authentication server sends to the requester’s phone or email address.
- Downloading a VPN client with a valid digital certificate and logging into the VPN before being granted access to a network.
- Swiping a card, scanning a fingerprint, and answering a security question.
- Attaching a USB hardware token to a desktop that generates a one-time passcode and using the one-time passcode to log in to a VPN client.
Why MFA?
One of the largest problems with traditional user ID and password login is the need to maintain a password database. Whether encrypted or not, if the database is captured, then it provides an attacker with a source to verify his guesses at speeds limited only by his hardware resources. Given enough time, a captured password database will fall.
In the past, MFA systems typically relied upon two-factor authentication. Increasingly, vendors are using the label “multifactor” to describe any authentication scheme that requires more than one identity credential.
Authentication Factors
An authentication factor is a category of credentials used for identity verification. For MFA, each additional factor is intended to increase the assurance that an entity involved in some kind of communication or requesting access to some system is who, or what, they are declared to be. The three most common categories are often described as something you know (the knowledge factor), something you have (the possession factor), and something you are (the inherence factor).
- Knowledge factors – information that a user must provide to log in, also called knowledge-based authentication (KBA). User names or IDs, passwords, PINs, and the answers to secret questions all fall under this category.
- Possession factors – anything a user must have in their possession in order to log in, such as a security token, a one-time password (OTP) token, a key fob, an employee ID card, or a phone SIM card. For mobile authentication, a smartphone often provides the possession factor, in conjunction with an OTP app.
- Inherence factors – any biological traits the user has that are confirmed for login. This category includes the scope of biometric authentication methods such as retina scans, iris scans, fingerprint scans, finger vein scans, facial recognition, voice recognition, hand geometry, even earlobe geometry.
- Location factors – the user’s current location is often suggested as a fourth factor for authentication. Again, the ubiquity of smartphones can help ease the authentication burden here: Users typically carry their phones and most smartphones have a GPS device, enabling reasonable surety confirmation of the login location.
- Time factors – Current time is also sometimes considered a fourth factor for authentication or alternatively a fifth factor. Verification of employee IDs against work schedules could prevent some kinds of user account hijacking attacks. A bank customer can’t physically use their ATM card in America, for example, and then in Russia 15 minutes later. These kinds of logical locks could prevent many cases of online bank fraud.
As you can see from this research, security is a complex topic and securing your data is not as easy as it was in the past. CTN can help you implement the appropriate security program for your organization using technologies like MFA. We want to make sure your business is safe!
Article Source: www.techtarget.com