IAM - Multi-Factor Authentication

What I've seen is it's very difficult to get a group of users all to create great passwords and practice good password management. And even if they did, there's things that threat agents can do to leverage credentials to get into systems. But most of that goes away when you use something like multifactor authentication. The improvement of going from an okay password to a great password is pretty small in comparison to when you incorporate something like multifactor authentication, which is one of the reasons why insurance agencies are requiring it if you're going to get cyber security insurance — because it's that big of an improvement.

From Single Factor to Multifactor

When you log into a system, you typically log in with a username and a password, and this is called single factor authentication. The single factor is this password that you enter. So if we wanted to do two factor authentication, that means that there's another factor involved. Two factor authentication is maybe at the same time we have to do a thumb print, so we would do a thumb print as our second factor.

Multifactor authentication is just anything besides a single factor authentication. That means there's multiple — two is multiple, three is multiple, four is multiple, whatever the case may be. It's just requiring more than one form of authentication.

The Categories of Factors

Factors can be broken down into five different categories: something you know, something you have, something you are, somewhere you are, or something you do. Some resources just list off these first three: something you know, something you have, and something you are.

Something you know would be something like a password, a PIN, a one-time password that you use once and then it goes away, a security word, or a security question.

Something you have would be something like — we're getting used to SMS messages, voice messages, email. We could also use certificates; we haven't gotten into certificates yet. But security keys, authenticator apps, tokens (both soft and hard tokens), and badges. So there are things that you have in your possession, whether it's on your computer or on your person, like a phone, that you can use to authenticate yourself.

Then there is something you are. This is things like a fingerprint, a palm print, voice, retina, signature, DNA — these are all examples of that.

Somewhere you are would be like an IP address or some sort of geolocation, and often geolocation is based off of IP address. But a geolocation would be like where you are at in this world. A good example of that would be, I get alerts if somebody logged into our email system from a foreign country, so that way we could figure out, are they on vacation or did somebody compromise the account?

And then something you do would be like you do something at a certain time, or there's a sequence of actions that you perform. A good example of this is maybe you're not able to log into your system unless during business hours.

Going Passwordless

Because of multifactor authentication, we actually have this concept of going passwordless. That means that maybe we don't need passwords in the future if we're using things like an authenticator app (something you have) and we're using something you are, like a fingerprint, or maybe it's a geolocation. Maybe we're using multiple items to authenticate you still, but without the need for a password. And so in some ways this can be very convenient, and maybe even more secure in some aspects.