Multi-Factor Authentication 101

Multi-Factor Authentication 101

You have probably already come across the term multi-factor authentication (MFA, sometimes 2FA). The concept is not new, but more vendors are suggesting and even requiring it to secure accounts on their systems. We will discuss what multi-factor authentication is and why you should be adopting it.

What is multi-factor authentication?
Multi-factor authentication is basically the use of more than one credential to gain access to data. It is a combination of multiple access credential types. For example, instead of gaining access to an account by just typing your username and password, you will be asked to further verify your identity by entering some other information, such as a PIN, a one-time password (OTP) sent to the phone number linked to the account. Mobile apps and fobs that generate new codes constantly are also being more widely used.

Why do you need multi-factor authentication?
Multi-factor authentication offers an additional layer of security. Simple access control measures such as logging in with user ID and password are increasingly being breached by cybercriminals because no matter how much we condition ourselves to follow good password hygiene, sometimes, we slip up. Have you ever been guilty of any of the following?

  • Writing down your password so you don’t forget it
  • Sharing your password with someone just to get the work done faster
  • Used the same password for multiple accounts just because it is easier to remember
  • Creating a password that is obvious or easy to figure out, such as your date of birth, numbers or letters in sequence, your name, etc.
Multi-factor authentication can help prevent cybercrimes that happen due to leaked or hacked passwords.

How does multi-factor authentication work?
Multi-factor authentication depends on a combination of the following three elements:

  • What you know
  • What you have
  • Who you are
The user has to prove their identity by answering the questions related to each of these three elements. User IDs, passwords, secret questions*, date of birth, etc., fall into the first category (What you know), while OTPs sent to your smartphone, a physical token or an access card belong to the second category (What you have) and the third category (Who you are) includes biometric authentication such as retina scan, fingerprint or voice recognition.

Multi-factor authentication is no guarantee of data safety, but it certainly reinforces your data security. While there are tools available in the market that you can purchase and deploy, you could also connect with an MSP to help you implement multi-factor authentication across your network smoothly.

*A note on secret questions: Some vendors still use secret questions, but they can be as problematic as passwords. Any publicly available information should not be used as answers to secret questions. This includes information from your own or other’s social media posts as well as public records. Make up fake, even nonsensical questions and answers to your accounts, and just like passwords, vary them from account to account.

Comments

Post a Comment

Popular posts from this blog

So, what, exactly, is Malware?

Image
So, what, exactly, is Malware? Listen to the news? Read the internet? You know cyber crime is a very big business. Hackers and criminals are out there doing all sorts of nefarious things. Most generally, you hear that malware is some kind of virus that attacks your software programs, infects your hardware, and bungles up your network. But there are many different types of malware, just as there are many types of criminals–each with their own MO and bad intentions. In this e-guide, we will run through some of the major categories of malware, and then suggest 7 different ways you can work to protect your business from malware. Malware defined - Malware is a generic term that covers all manner of software that is designed to attack your devices, applications, programs, and networks. It is software that has bad intentions. Malicious + Software= Malware. Hackers and criminals create malware for an array of reasons. Some may create it just to attack massive amounts of machines just to show t...
Read more

Infection protection: Nine steps to start protecting your company today

Image
Infection protection: Nine steps to start protecting your company today Malware is a generic term that covers all manner of software that is designed to attack your devices, applications, programs, and networks. It is software that has bad intentions. Yes, stealing. Either by directly pulling money out of accounts, or improperly acquiring data that ultimately provides access to funds. Example: Stealing your SSN and setting up a credit card to use that info, or convincing you to provide the password to your checking account. Others will snatch your organization's data and hold it for ransom. As usual, it is all about money. What can you do? Nine steps to avoid malware 1) Don’t go it alone - As a small- to medium-sized business, you have limited resources, all of which need to be focussed on running the business and planning for the future. That makes it difficult to direct an IT operation that has the depth to address all of the security issues you face. For example, a business owne...
Read more

Thing to do this week to start protecting your customer data

Image
Thing to do this week to start protecting your customer data You have client or customer data in your possession. It is part of running your business in a digital marketplace. If that data is breached, it could permanently damage your reputation. We talked in an earlier blog about types of malware. There are many steps that you can take to protect your systems and data. Here are a few suggestions to protect your business from malware. Consider a Managed Service Provider - Cybercriminals are very sophisticated and every day are releasing new, cutting-edge tools to attack businesses and individuals. Small- and medium-sized businesses do not have the resources to staff an IT department sufficiently to be aware of all the newest tools and technologies needed to protect a business. For example, a business owner cannot possibly keep up with the changes and details of tax laws. Doing it themselves, they would likely overlook important tax advantages or inadvertently break some IRS rule. As ...
Read more