Multifactor authentication (MFA) is a security technology that requires multiple methods of authentication from independent categories of credentials to verify a user's identity for a login or other transaction. Multifactor authentication combines two or more independent credentials: what the user knows, such as a password; what the user has, such as a security token; and what the user is, by using biometric verification methods.
The goal of MFA is to create a layered defense that makes it more difficult for an unauthorized person to access a target, such as a physical location, computing device, network or database. If one factor is compromised or broken, the attacker still has at least one or more barriers to breach before successfully breaking into the target.
Types of Multi-Factor Authentication
There are a number of different checks you can use to implement MFA— and the list is always growing. We have picked the common ones here:
1. SMS Token Authentication
A relatively straightforward measure to implement, especially for consumers and the general public, this check most often consists of a text message containing a PIN number. This PIN is then used as a one-time password (OTP), usually in addition to traditional username-and-password verification.
If your customers frequently access your services from mobile devices, it’s wise to offer them this or another mobile-device-based authentication method to help smooth the consumer journey.
2. Email Token Authentication
This method is Identical to SMS tokens, but the code is sent via email. Since not everyone has their phone with them all the time, it’s a good idea to offer this option. It can act as a backup method if your customer has had their mobile device lost or stolen. It’s also a convenient way to access an OTP from any platform that can receive email.
3. Hardware Token Authentication
Using a separate hardware token is considered one of the most secure authentication methods available, as long as the key remains in the consumer’s possession. This method is more expensive, although it can be cost-effective to provide your high-value consumers with dongles for free.
Business customers tend to be more willing to go the extra mile to use a hardware token, and adoption of hardware tokens is increasing. But it’s still not a good idea to make them compulsory for anyone but the most high-value, at-risk customers such as banking, insurance, and investment clients.
Users just need to insert the hardware token into their device to use it. If they use a mobile device for access, they may need another dongle to add a USB or USB-C port to their smart device.
4. Software Token Authentication
By using an authentication application on a mobile device, you can get almost the same level of security as with a hardware token. Essentially, the smart device becomes the token. This can be tied in with services like Google Authenticator.
Getting customers to use a third-party solution can help encourage them to use MFA for more of their services outside of your business, thus increasing their overall security. It also makes a great alternative to carrying an additional dongle to attach a hardware token to a smart device.
5. Phone Authentication
Randomly generated one-time password (OTP) sent by SMS is one of the most common ways to authenticate users via phone. Another way is via automated phone calls.
6. Biometric verification
People with a smart device or computer with biometric authentication (such as fingerprint ID or facial recognition) can use this check to confirm their identity as part of MFA. Biometric ID verification tends to be less hassle than typing in an OTP, so customers find it less aggravating to use it frequently. The lower friction makes it an ideal option when extra checks are unavoidable.
Additional Forms of Multi-Factor Authentication
There are a few other digital verification methods available to your customers.
1. Social Login
Social login, also called social identity verification, is something many users find convenient since they’re usually already logged in to the relevant accounts. Bear in mind though that social media platforms are high-value targets for hackers, so social ID verification shouldn’t be the only method used on top of username/password in most cases.
2. Security Questions
Security questions are a type of knowledge-based authentication (KBA) where the questions and answers are static. The questions could be defined by the business or the customer, and the customer provides the answers that are later verified. Dynamic KBA, which is more secure than static KBA, uses questions that are generated in real-time based on data records such as credit history or transactions.
3. Risk-Based Authentication
Risk-based authentication (RBA) can also be used in conjunction with MFA. By monitoring things like location, device, and even user keystrokes, you can tailor the frequency of MFA checks to the security situation. RBA helps avoid asking customers for extra verification repeatedly when they’re signing in from their “home” machine and location.
4. Time-based One-Time Passcode Authentication
A time-based one-time password (TOTP) is a passcode generated for a user in the current time, and it is valid for a set timeframe. Using this authentication method, you are basically creating a one-time password on the user side with the help of a smartphone. Because TOTP has nothing much to do with the server-side, it means the user will always have access to their one-time password on their smartphone.
How Multi-Factor Authentication Works
Multi-factor authentication classified into two categories:
MFA for devices: A two-factor authentication process that verifies a user at the point of login.
MFA for applications: A two-factor authentication process that verifies a user to allow access to one or more applications.
However for both MFA functions in the same way. Here's how the process is usually carried out.
Multi-factor authentication is introduced in the user account, and the system is connected to an app or program from MFA.
The user is asked to enter the token associated with the account. It can be in the form of a random number created by an MFA app like the Google Authenticator.
The hacker will need to have access to the token in order to break into your account. That's why MFA is such an asset in boosting your IT security.
Features:
Better security: It provides additional protection for consumers and employees in multiple security layers.
Boosted conversion: A streamlined authentication process keeps productivity high, leading to increased conversions.
Improved customer trust: Due to extra security checks, consumers and employees are rest assured about the data.
Reduced operating costs: The more the layers, the more is the risk of intruders from data breaches is reduced, leading to reduced investment.
Achieve compliance: Specific to your organization to mitigate audit findings and avoid potential fines.
Increase flexibility and productivity: The ability to remove the burden of passwords leads to better productivity.
Advantages:
adds layers of security at the hardware, software and personal ID levels;
can use OTPs sent to phones that are randomly generated in real time and is difficult for hackers to break;
can reduce security breaches by up to 99.9% over passwords alone;
can be easily set up by users;
enables businesses to opt to restrict access for time of day or location; and
has scalable cost, as there are expensive and highly sophisticated MFA tools but also more affordable ones for small businesses.
Disadvantages:
a phone is needed to get a text message code;
hardware tokens can get lost or stolen;
phones can get lost or stolen;
the biometric data calculated by MFA algorithms for personal IDs, such as thumbprints, are not always accurate and can create false positives or negatives;
MFA verification can fail if there is a network or internet outage; and
MFA techniques must constantly be upgraded to protect against criminals who work incessantly to break them.
The Tech Platform
Comments