The Evolution of Cybersecurity: Multi-Factor Authentication (Part 3)

When you’re logging in to an account, whether it be for work, entertainment, social media, or so on, multi-factor authentication means that one single authentication factor isn’t sufficient to gain access. The term “multi”, in multi-factor authentication, suggests that at least two or more authentication factors are required to log in successfully. Here are the possible forms of authentication factors:

• Knowledge
  • Personal Security Questions
  • Password
• Possession
  • Smartphone Applications
  • One-time password sent by text or email
• Inherence
  • Biometrics (Voice, Face, Fingerprint, etc.)

Imagine you have a vault containing your personal belongings. A passcode is necessary to unlock the vault. However, consider the possibility that someone gains knowledge of the passcode, and they intend to gain access to the vault. Upon entering the passcode to the vault, they are then prompted to input a second form of authentication, such as a valid fingerprint scan. Thus, their one form of authentication which they have access to is useless without the other. This is an example of multi-factor authentication.

Of course, it is far more difficult for criminals to gain access to multiple forms of authentication, and that is why multi-factor authentication is the third entry in The Evolution of Cyber Security series. This is a form of user-based security which is necessary for businesses moving to the cloud—given they are no longer working exclusively from office computers. Instead, cloud-based businesses often work remotely, even using their own personal devices for work-related tasks. The problem is that this increases the chance of an unauthorized individual gaining access to one of these devices, and potentially the credentials to access that particular organization’s login portal.

actorsThe term “multi”, in multi-factor authentication, suggests that at least two or more authentication factors are required to log in successfully. Here are the possible forms of authentication factorsCisco Secure Access by Duo specializes in multi-factor authentication. Whether it’s an individual or an entire organization, they make the process of setting up multi-factor authentication simple, and user-friendly. They also provide the option to choose any of the forms of authentication, whether it be knowledge, possession, or inherence.

Multi-factor authentication has proven itself to be a crucial addition to any endpoint security strategy. This is simply because if someone who isn’t you is trying to get into your account, they will need more than one set of authenticating credentials, which aren’t stored together. Without multi-factor authentication, if your password is ever accidentally shared, or somehow becomes public, then there is nothing preventing other people from posing as you—in which case your account may become compromised. If this is the case, once an intruder gains access to your account, it may be difficult to seize and retrieve that account. Reaching out to customer support isn’t always straightforward. The process in which you confirm your identity and declare that your account has been compromised (and possibly hijacked) isn’t enjoyable. Furthermore, the damage done by the intruder may even be irreversible, especially if they have stolen any personal information or private data.

The thing is, “accidentally sharing” your password is the least of your worries. The risks which you should primarily be concerned with are malware and phishing. First, malware is defined as malicious software which infiltrates a device and is able to search for passwords, track websites you’ve visited, and watch what you type using a keystroke logger. If you do not have proper endpoint protection, as discussed in the previous entry in The Evolution of Cybersecurity series, then you may be vulnerable to malware. Second, phishing entails a criminal posing as a trusted source and reaching out to individuals (via email, text, etc.) in hopes of tricking them into giving up personal information. Training oneself to be more knowledgeable regarding cybersecurity can improve one’s ability to identify and mitigate phishing attempts, considering not all attempts are successfully filtered out using just software. The idea is that criminals are actively employing tactics to steal your credentials.

Overall, multi-factor authentication isn’t just recommended, it’s necessary. According to Statistics Canada there have been significant increases in cybersecurity threats over recent years. Of course, using a simple password nowadays can be quite foolish. Instead, longer “passphrases” are recommended—specifically those which contain mixed characters and numbers. Furthermore, it is recommended that these passphrases be unique to every account and device. If you use the same password for multiple accounts, the cyber criminal may gain access to all of them. Computer scientists state that longer and more complex passcodes are far more difficult to crack with brute force attacks.

Multi Part Series: The Evolution of Cybersecurity Part 1: What Poor Endpoint Protection Entails Part 2: Ideal Endpoint Protection Part 3: The Need for Multi Factor Authentication Part 4: The Risks of Working from Home – A Zero Trust Approach Part 5: Running Virtual Penetration Tests Part 6: Is Your MSP Keeping You Secure?

Featured Download