Multi-Factor Authentication - Initial Setup

Introduction to Multi-Factor Authentication

In 2017, a new standard for digital identity was released, addressing the need for stronger digital identity and making an important addition: it categorized multi-factor authentication (MFA) as the single best technique organizations could deploy to address risks with most assuredly authenticating their users. The guideline encourages users to use MFA wherever possible, and the commercial technologies to support the strategy are there. However, one quick skim of the guidelines makes it clear that most organizations, particularly those on less discretionary budgets, receive a clear message that deploying MFA is going to be either difficult or impossible. Even if an organization figures out the right combination of factors, the complexity and availability of those factors make this solution out of reach for many organizations.

However, emerging technologies as well as encouraging actions by companies have, in many respects, changed this assessment. This text will review the various ways that organizations can implement a strong risk management strategy using MFA. We will address the factors that the revised guidelines recommend, discuss strengths and weaknesses of various factors and gestures, dig into some best practices for enrollment, and finally, identify some top commercial products that can either expand or simplify the factors an organization might easily use. By the end of this text, we hope to provide a roadmap for organizations trying to deploy supportive, collaborative, and productive MFA programs.

Key Components of Multi-Factor Authentication

The value of any network is data. While a network that uses firewalls and intrusion protection tools is necessary, a network security strategy targeting only NIDS and firewalls does little to protect valuable data. Instead, a network security strategy will have as its foundation the network’s core resource. In addition to technologies like intrusion protection and detection systems and firewalls, a primary emphasis on securing data includes the concept of multi-factor authentication. In the balance of this paper, the components of multi-factor authentication are outlined, the concept of an authentication appliance is introduced, a deployment model for consideration is presented, and the business benefits of implementing multi-factor authentication are discussed. Additionally, a checklist of data security-related metrics that can measure the success of a multi-factor authentication implementation is provided. After all, if you don’t measure it, you can’t manage it.

Initial Setup Process

When beginning to set up multi-factor authentication (MFA), there are certain core foundational and universal requirements that must be satisfied regardless of which technologies are to be implemented. Firstly, it is necessary to define three characteristics of the overall environment that are key to MFA. It is paramount to identify who or what needs to be protected. The process of identifying assets, vulnerabilities, and threats all comes into play here. Identifying and quantifying the factors in that environment is a key element in defining security goals. The process assumes that no multi-factor technology will be foolproof, and the more the system is needed to be foolproof, the more intrusive and infeasible the factors often get, and convenience is often significantly restricted.

Secondly, it is important to clarify for which specific systems MFA should be implemented. Whether there exists a law, regulation, or industry standard requiring that system to be protected with multi-factor authentication will dictate part of the decision but should not be the only factor taken into consideration. Authorization for the desired access must also be defined and understood. If authorized access does not actually need multi-factor authentication, why use it? Conversely, if access must be prevented from being authorized, why allow it through any other authentication? Do you have connections between untrusted environments? Are any data connections classified as sensitive? What are the critical security zones and at what connection points are your information exchange points?

Best Practices for Implementing Multi-Factor Authentication

Intuition dictates that higher multiplicities of factors for user authentication should confer improved confidence that the authenticated user is actually the claimed user. However, in the real world, factors and methods are subject to both implementation errors on the backend and misuse by end users. Just because an organization has properly implemented MFA does not mean that security can be compromised if users try to be clever. Simply put, MFA is no silver bullet; it will reduce the likelihood that unauthorized persons can access critical resources, but it cannot eliminate that potential entirely.

The best multi-factor authentication techniques involve selecting multiple factors across multiple categories, such as something you know, something you are, and something you have, using information from distinct data repositories, and integrating what would traditionally be separate authentication attempts into a single unified process. This unified authentication mechanism should be used to access all secured resources in accordance with business risk management goals. The following steps or best practices offer very important recommendations for implementation and optimization of multi-factor authentication in the modern enterprise environment.

Optimizing Multi-Factor Authentication for Enhanced Security

MFA is not the same as strong authentication. MFA involves the combination of credentials and the involvement of at least two of the three factors of authentication. Strong authentication involves a level of misunderstanding. The term 'strong' does not indicate any specific level of security. It is based on the strength of user authentication, which highly relies on the legitimacy of a credential, unlike multiple authorities. The credibility will largely be based on the careful use of a more secure protocol. MFA provides a solution that adds additional security layers to existing security technology. If the initial authentication means is secured, then the added security of two or multiple layers reduces fraud and other risks. The purpose of using multi-factor physiological authentication is to increase security, so if both factors are not needed to be entered to validate the person, then it has little value. Therefore, physiological properties serve as secure sources of biometric factors by adding to a more basic user authentication, which previously allowed 3D passwords.

Step-up SMS and one-time passwords: Without additional security like risk-based management or two-step authentication, SMS and one-time passwords have grown to be simple to bypass, and an unauthorized user who is determined would still find access to the victim’s account. There are increasingly powerful, inexpensive approaches for hacking a friend or actually simulating the handset of the user, resulting in a cell phone associated with a pre-determined carrier. Opting for message protection by a more robust choice is suggested. Some phone network workers assign an independent PIN to secure hundreds of numbers connected with that account. Many mobile devices are useful in achieving the same goal with providers as in the private sector. These systems are very useful and inexpensive to merge.