Cybersecurity
Multi-factor authentication (MFA) is one of the fundamental cybersecurity protocols that prevents unauthorized users from accessing sensitive information and employee accounts.
Video
4 minute read
Jul 24, 2024
Multi-factor authentication (MFA) is an important security measure that makes users confirm their identity through a secondary authorization after providing their user credentials. This secondary verification ensures users are who they say they are and makes it much harder for a hacker to compromise accounts.
There are three different types of multi-factor authorization and those are:
If you want to learn more about the anatomy of a cyberattack and how they play out, take a minute to watch Impact’s webinar, Dissecting Cybersecurity Breaches: How They Happen and How to Stop Them.
With a fundamental understanding of MFA, let’s review the three different verification methods in a bit more depth. Each of the secondary authorization tactics, (something you know, something you have, something you are), function in different ways which might influence the MFA verification protocol you ultimately choose.
"Something you know" refers to a piece of information that only the user is supposed to know, such as a password, passphrase, PIN, or security question answer. This is the most common form of authentication and relies on the secrecy of the information. The user must provide this information correctly to gain access to a system or account. However, this method has vulnerabilities.
Passwords can be weak, reused, or guessed, and they can be exposed through phishing attacks or data breaches. To enhance security, it's recommended to use complex, unique passwords for different accounts and to update them regularly. Security questions should be selected and answered in a way that the information is not easily guessable or obtainable by others.
"Something you have" involves the possession of a physical device that can authenticate the user. This could be a smartphone with a mobile authenticator app, a hardware token, or a smart card.
When a user attempts to log in, the system sends a verification code to the device, or the user must insert or tap the device to authenticate. This method adds a layer of security because it requires the physical possession of an item that should only be in the user's hands. Even if a password is compromised, an attacker would still need the physical device to gain access.
However, this method requires a backup plan just in case the user loses the device or has it stolen.
"Something you are" uses biometric authentication, which involves unique biological characteristics of the user. Common biometric methods include fingerprint scanning, facial recognition, voice recognition, and iris or retinal scanning. These characteristics are difficult to replicate, making this method highly secure.
For example, a fingerprint scanner reads the unique patterns on a user's fingertip, while facial recognition software analyzes specific facial features. Biometric data is usually stored in an encrypted format to prevent misuse. Although highly secure, biometric systems can raise privacy concerns and may be prone to errors, such as false rejections, or worse, false positives.
Additionally, biometric data, if compromised, cannot be changed like a password or replaced like a physical device.
Multi-factor authentication is one of the fundamental security protocols that is extremely easy to implement but incredibly effective in preventing unauthorized access to accounts and devices. By creating a security policy with an MFA protocol, you can better protect employee accounts and devices, and in turn, company information and your network as a whole.
All-in-all, MFA protocols are an incredibly important aspect of an overall cybersecurity strategy that prevents unauthorized users from accessing systems. However, multi-factor authentication is only one component of comprehensive cybersecurity and should be paired with a suite of other cybersecurity protocols and mechanisms.
Learn how cyberattacks typically unfold and how cybersecurity professionals actively work to stop them in Impact’s webinar, Dissecting Cybersecurity Breaches: How They Happen and How to Stop Them.
Sign up for The Edge newsletter to receive our latest insights, articles, and videos delivered straight to your inbox.