Multi Factor Authentication (MFA)

What I've seen is it's very difficult to get a group of users all to create great passwords and practice good password management, and even if they did, there are things that threat agents can do to leverage credentials to get into systems. But most of that goes away when you use something like multifactor authentication.

The improvement of going from an okay password to a great password is pretty small in comparison to when you incorporate something like multifactor authentication, which is one of the reasons cyber security insurances are requiring it. Insurance agencies are requiring it if you're going to get cyber security insurance, because it's that big of an improvement.

Single factor, two factor, multifactor

When you log into a system you typically log in with a username and a password. What happens is that this is called single factor authentication, and the single factor is this password that you enter.

If we wanted two factor authentication, that means that there's another factor involved. So two factor authentication is maybe at the same time we have to do a thumb print, so we would do a thumb print as our second factor.

Multifactor authentication is just anything besides single factor authentication. That means there's multiple: two is multiple, three is multiple, four is multiple, whatever the case may be. It's just requiring more than one form of authentication.

Two step verification just means that this is happening in two steps. The first step, in this scenario right here, we're asking for the username and password. Once they verify who they are, they're going to go through a second step — in this case right here it's a one-time password, maybe through SMS, that they're going to enter in here, and that's the second step of this verification.

The five categories of factors

Factors can be broken down into five different categories: something you know, something you have, something you are, somewhere you are, or something you do. Some resources just list off these first three: something you know, something you have and something you are.

Something you know would be something like a password, a PIN, a one-time password that you use once and then it goes away, a security word or a security question.

Something you have would be something like — we're getting used to SMS messages, voice messages, email. We could also use certificates; we haven't gotten into certificates yet. But security keys, authenticator apps, tokens both soft and hard tokens, and badges. So there are things that you have in your possession, whether it's on your computer or on your person like a phone, that you can use to authenticate yourself.

Then there is something you are. This is things like a fingerprint, a palm print, voice, retina, signature, DNA — all examples of that.

Somewhere you are would be like an IP address or some sort of geolocation. Often geolocation is based off of IP address, but a geolocation would be like where you are at in this world. A good example of that is I get alerts if somebody logged into our email system from a foreign country, so that we could figure out, are they on vacation or did somebody compromise the account?

Then something you do would be like you do something at a certain time, or there's a sequence of actions that you perform. A good example of this is maybe you're not able to log into your system unless it's during business hours.

Tokens, hard and soft

When it comes to something you have, perhaps what you have is a token. A token is just a visible or tangible representation of something — that's what the word token means. A good example of this might be this card that I have right here. This is for my gym membership. It isn't my membership, but it's a representation of my membership. The fact that I have this allows me to get into the building, because I have this token here that shows that I'm a member of that gym. So a token is a representation.

When it comes to granting access to something, we have hard tokens and soft tokens. A hard token might be something like a USB drive that we stick in, or a USB dongle that we stick in, or some sort of key fob that we have, or maybe it's some sort of card access. It's a token that gives us access into something.

There are also soft tokens. A soft token would be maybe you have your phone, and so what's sent to your phone is a code, and that code now is the token to get into something. So that's a soft token. These are some different representations of hard and soft tokens.

Going passwordless

Because of multifactor authentication, we actually have this concept of going passwordless. That means that maybe we don't need passwords in the future, if we're using things like an authenticator app, something you have, and we're using something you are like a fingerprint, or maybe it's a geolocation. Maybe we're using multiple items to authenticate you still, but without the need for a password. In some ways this can be very convenient.