Let us talk about the definitions of the three factors of authentication.

• One-factor authentication – this is “something a user knows.”  The most recognized type of one-factor authentication method is the password.
• Two-factor authentication – in addition to the first factor, the second factor is “something a user has.”  Examples of something a user has are a fob that generates a pre-determined code, a signed digital certificate or even a biometric such as a fingerprint.  The most recognized form of two-factor authentication is the ubiquitous RSA SecurID fob.
• Three-factor authentication – in addition to the previous two factors, the third factor is “something a user is.”  Examples of a third factor are all biometric such as the user’s voice, hand configuration, a fingerprint, a retina scan or similar.  The most recognized form of three-factor authentication is usually the retina scan.

The important thing to notice about the aforementioned definitions is that no where do they mention using two passwords or passphrases, two fingerprints or two retina scans.  Such use of two of the same factors is considered multi-factor authentication and is not related to any of the aforementioned definitions.  So those of you that are using two different user identifiers and passwords are not using two-factor authentication, you are using multi-factor authentication.  The PCI DSS is very specific in requirement 8.3 and requires two-factor authentication or better.  So multi-factor is not acceptable.

Another thing to mention is that security purists will argue that using a biometric for a second factor violates the rules of the third factor.  However, other security practitioners say that something a user has or they are can be either something like a token or a biometric.  Their logic is that a user has a fingerprint or a retina, so it qualifies as either factor.  The key is to only use a particular biometric once.  So if you use a fingerprint for your second factor, you cannot use a fingerprint for the third factor.

Finally, while obvious, a lot of people miss this point.  One-factor is less secure than two-factor which is less secure than three-factor authentication.  However, if users properly construct their passwords or passphrases and other logon restrictions are in place, one-factor authentication can be fairly effective against security breaches, possibly in the 90% range.  Two factor authentication typically raises the effectiveness to probably around 97 or 98%.  And three-factor authentication likely takes things to a six sigma level of effectiveness.  Note that even with three-factor authentication you only get to 99.9999% effectiveness.  As I have repeatedly pointed out, security is not perfect.

A lot of people do not realize the fact that they use two-factor authentication regularly.  In order to use an ATM you need a card (something you have) and a four digit personal identification number or PIN (something you know).  Another example that is common these days is in order to enter secure facilities, an authorized user is required to use their HID access card and enter a PIN into a keypad before a door will open.  Something to note is that it does not matter the order in which the factors are used.  In the case of the ATM and entry examples, you swipe your card (something you have) first and then enter your PIN (something you know).

Just because the second factor is something a user has, does not mean that the user must know they have it.  A prime example is in the case of a digital certificate.  A lot of organizations issue a digital certificate with their VPN software to provide two-factor authentication.  Most users are unaware that they need a digital certificate to make the VPN work.  The digital certificate is usually tied to the user or the computer and is installed as part of the installation of the VPN software.  The only way a user ever becomes aware of the digital certificate is if it is ever corrupted or becomes out dated resulting in an error when they try to connect to the VPN. (NOTE: In the Council’s Multi-Factor Authentication Information Supplement from 2017, the use of digital certificates as discussed here was disallowed for meeting PCI compliant two-factor authentication.)

Another important point is that in instances where all you use is your HID access card, you are using one-factor authentication.  The definitions for the factors were established for ease of learning and memory.  However, using any of the factors alone is one-factor authentication.  Using each type of factor in conjunction with another, results in two- and three-factor authentication.  As such, you can use different combinations of all of the factors to decrease the likelihood of a compromise.  For example, in a lot of spy movies, there is an ultra-secure room where to gain entry, you need for example an ID card, a PIN, a retina scan and you need to say your passphrase.  This is not an example of four-factor authentication; this is three-factor authentication with the use of two biometric factors (i.e., multi-factor).

Finally, there is a risk in using biometric factors that most people do not like to talk about but is important to consider.  People suffer accidents all of the time.  Fingers get cut or even removed.  Hands get broken or maimed.  Eyes become damaged.  People lose their voices.  As a result, if you are looking to use biometrics for authentication, make sure you plan for such incidents.

Hopefully you now understand the various factors of authentication and understand how they are used.

WHAT IS THREE FACTOR AUTHENTICATION?

Three-factor authentication, also known as 3FA, is the use of identity-confirming credentials from three separate layers of authentication.

The standard 2FA includes the provision of credentials and a one-time authentication code via SMS.

The third layer in 3FA uses the end user’s live biometric data to authenticate them to offer the highest level of security. This allows companies to add a layer of confidence when authorizing access to customer accounts remotely.

Three-factor authentication (3FA) is the use of identity-confirming credentials from three separate categories of authentication factors– typically, the knowledge, possession and inherence categories.

Multi-factor authentication  dramatically improves security. It is unlikely that an attacker could fake or steal all three elements involved in 3FA, which makes for a more secure log in.

Authentication factors classically fall into three categories:

What are the characteristics of authentication?

In authentication, the user or computer has to prove its identity to the server or client. Usually, authentication by a server entails the use of a user name and password. Other ways to authenticate can be through cards, retina scans, voice recognition, and fingerprints.

ANALYSIS OF AUTHENTICATION ,AUTHORIZATION AND ENCRYPTION

Authentication

• Authentication is used by a server when the server needs to know exactly who is accessing their information or site.
• Authentication is used by a client when the client needs to know that the server is system it claims to be.
• In authentication, the user or computer has to prove its identity to the server or client.
• Usually, authentication by a server entails the use of a user name and password. Other ways to authenticate can be through cards, retina scans, voice recognition, and fingerprints.
• Authentication by a client usually involves the server giving a certificate to the client in which a trusted third party such as Verisign or Thawte states that the server belongs to the entity (such as a bank) that the client expects it to.
• Authentication does not determine what tasks the individual can do or what files the individual can see. Authentication merely identifies and verifies who the person or system is.

Authorization

• Authorization is a process by which a server determines if the client has permission to use a resource or access a file.
• Authorization is usually coupled with authentication so that the server has some concept of who the client is that is requesting access.
• The type of authentication required for authorization may vary; passwords may be required in some cases but not in others.
• In some cases, there is no authorization; any user may be use a resource or access a file simply by asking for it. Most of the web pages on the Internet require no authentication or authorization.

Encryption

• Encryption involves the process of transforming data so that it is unreadable by anyone who does not have a decryption key.
• The Secure Shell (SSH) and Socket Layer (SSL) protocols are usually used in encryption processes. The SSL drives the secure part of “https://” sites used in e-commerce sites (like E-Bay and Amazon.com.)
• All data in SSL transactions is encrypted between the client (browser) and the server (web server) before the data is transferred between the two.
• All data in SSH sessions is encrypted between the client and the server when communicating at the shell.
• By encrypting the data exchanged between the client and server information like social security numbers, credit card numbers, and home addresses can be sent over the Internet with less risk of being intercepted during transit.

Using authentication, authorization, and encryption

Authentication, authorization, and encryption are used in every day life. One example in which authorization, authentication, and encryption are all used is booking and taking an airplane flight.

• Encryption is used when a person buys their ticket online at one of the many sites that advertises cheap ticket. Upon finding the perfect flight at an ideal price, a person goes to buy the ticket. Encryption is used to protect a person’s credit card and personal information when it is sent over the Internet to the airline. The company encrypts the customer’s data so that it will be safer from interception in transit.
• Authentication is used when a traveler shows his or her ticket and driver’s license at the airport so he or she can check his or her bags and receive a boarding pass. Airports need to authenticate that the person is who he or she says she is and has purchased a ticket, before giving him or her a boarding pass.
• Authorization is used when a person shows his or her boarding pass to the flight attendant so he or she can board the specific plane he or she is supposed to be flying on. A flight attendant must authorize a person so that person can then see the inside of the plane and use the resources the plane has to fly from one place to the next.

Here are a few examples of where encryption, authentication, and authorization are used by computers:

• Encryption should be used whenever people are giving out personal information to register for something or buy a product. Doing so ensures the person’s privacy during the communication. Encryption is also often used when the data returned by the server to the client should be protected, such as a financial statement or test results.
• Authentication should be used whenever you want to know exactly who is using or viewing your site. Weblogin is Boston University’s primary method of authentication. Other commercial websites such as Amazon.com require people to login before buying products so they know exactly who their purchasers are.
• Authorization should be used whenever you want to control viewer access of certain pages. For example, Boston University students are not authorized to view certain web pages dedicated to professors and administration. The authorization requirements for a site are typically defined in a website’s .htaccess file.
• Authentication and Authorization are often used together. For example, students at Boston University are required to authenticate before accessing the Student Link. The authentication they provide determines what data they are authorized to see. The authorization step prevents students from seeing data of other students.

Advantages of 3-Factor Authentication (3FA)

The benefits of 3-factor authentication offer security to all organizations that have sensitive data they need to protect from falling into the wrong hands and prevent cyber security attacks

1. Improved Security

The primary and most obvious benefit of MFA is that it greatly improves an organization’s security by adding another layer an intruder would have to penetrate in order to gain access to sensitive data and protected systems.

Especially now, when many employees are working from their homes, exposed to dangerous cyber threats such as phishing relying on passwords alone can be a costly mistake. According to reputable password security statistics, about 80 percent of data breaches are caused by password compromise.  

Because 3FA can reliably block 99.9 percent of automated attacks on passwords, as revealed by Microsoft, it should be part of every organization’s cybersecurity toolkit.

2. Protection Against Credential and Device Theft

Not all data breaches involve a hoodie-wearing cybercriminal entering obscure commands on his computer to remotely circumvent state-of-the-art intrusion detection systems. Sometimes, all it takes for an organization to lose valuable data is someone glancing at a remote employee’s laptop and remember their password.  

MFA protects against credential theft by ensuring that a password alone is never enough to authenticate a login attempt. When combined with full-disk encryption, it can also effectively protect against device theft and all the issues associated with it.

3. Easy to Implement

Out of all cybersecurity solutions that organizations can implement to protect themselves against the myriad of threats they face on a daily basis, MFA is among the least costly to implement. As long as your existing business software supports it, which it most certainly does, implementing any form of MFA can be virtually non-intrusive, causing no downtime whatsoever.  

4. Single Sign-On (SSO) Compatibility

Single sign-on (SSO) is a productivity-enhancing authentication method that makes it possible for users to authenticate with multiple applications and websites with just one set of credentials. SSO is secure because of the relationship identity providers have with service providers.

However, SSO can be even more secure when paired with MFA. In practice, users who haven’t logged in yet to an application or website can be asked to enter a one-time password (OTP), delivered to them via a smartphone app or SMS message. That way, an active login session can’t be exploited to unlock additional digital doors.

5. Regulatory Compliance

Implementing MFA is often a key requirement for achieving compliance with data protection laws and regulations. A good example of this is the Payment Card Industry Data Security Standard (PCI-DSS), which requires multi-factor authentication to be implemented in certain situations to prevent unauthorized access.

Of course, all customers can appreciate when their personal information is protected, so the implementation of MFA can be a great way for organizations to increase their reputation and establish themselves as trustworthy business partners.

Our Advice: Implement Multi-Factor Authentication Now

All organizations have important data and systems to protect, but traditional password-based authentication doesn’t deliver sufficient protection anymore. The good news, is that multi-factor authentication does quickly improve your security, and implementing it could hardly be any easier.

Drop your comment