The volume of data breaches continues to grow with over 37 billion breached data records reported in 2020. Often, users try to increase the security of their data by changing passwords to save themselves from a data breach, but passwords alone may not be enough to secure personal data. Here Multi-Factor Authentication (MFA) comes into the picture. MFA is one of the most common alternatives that can fix the general shortcomings associated with passwords.
What Is Multi-Factor Authentication?
MFA is used to authenticate if the identity of a user is genuine. It requires a user to present two or more pieces of evidence, or factors, for authentication. A key goal for MFA is to add additional authentication factors to increase security. The well-designed multi-factor authentication strategy strives to maintain a balance between added security and user convenience.
Benefits of Multi-Factor Authentication
Multi-factor authentication aims to provide extra layers of security by requiring additional authentication factors. Some of the key benefits of using a multi-factor authentication system include:
MFA enables stronger authentication
The primary objective of multi-factor authentication is to reduce the risk of account takeovers and provide additional security for users and their accounts. Since over 80% of cyber breaches happen due to weak or stolen passwords, MFA can provide added layers of security necessary to protect users and their data. If one of the factors such as a user’s password is stolen or breached, the other factors provide an additional layer of security and assurance of the user identity.
Types of Multi-Factor Authentication
MFA requires the use of multiple (at least two) factors to verify authorized access by the user. There are three main types of authentication factors used, and for each factor, there are different methods for authentication:
- Knowledge - Something you know
It typically includes information that is known only to the user. The combination of a username and password or PIN are the most common examples of a knowledge factor. Some organizations may require security questions such as the mother’s maiden name or name of the school first attended to verify the user’s identity.
- Possession - Something you have
The possession authentication factor is helpful when users have something specific in their custody, such as physical tokens, smart cards, key fobs or mobile phones. Google authenticator is a good example of an app of the phone as a token. It is unlikely that a hacker who has stolen a user's password also has stolen their physical possession as well. This type of authentication may include confirming through a pop-up notification on a mobile phone or requiring the insertion of a security card, or even, the outdated and deprecated one-time password, which could be provided via text message or email.
- Inherence - Something you are
The inherence factor uses behavior or biological traits of the users for login purposes. Commonly used inherence factors include fingerprints, retinal scan or voice or facial recognition. Behavioral biometrics and recognition signals are also inherence factors, since it is difficult for fraudsters to mimic or fake user behavior. This type of authentication is considered to be not only strong, but also the type with lowest friction for users.
A comparison list of MFA methods, with a ranking of both level of security and friction is shown in the following table
Applications may use combinations of these factors and authentication mechanisms that best suit them depending on the costs, IT structure and security strength they require. An example of multi-factor authentication includes a mobile bank, which after requiring a password (knowledge) for login for users to gain access to the account, additionally prompts the user to input a number from an authenticator app on a mobile phone (possession). Another valid example could be a fintech app using zero-factor authentication powered by location behavior (inherence), which would enable a passwordless login and money transfer for the user. If the user location behavior does not match the usual, an authenticator app could generate the necessary token for validation, thus authenticating the trusted user, or preventing the access of a fraudster.
What is the MFA process used for?
Organizations use MFA for a variety of reasons. Three primary purposes of MFA implementation include:
Security: Enhancing the security and safety of business information and operation is the chief purpose of multi-factor authentication. The strength of a technological safety system depends on the number of layers or factors incorporated in the software. Systems using two or more authentication factors are considered safer than others.
Usability: Working with MFA provides an opportunity to eliminate the use of passwords. The average user has in excess of 40 mobile apps and managing to remember complex passwords for each account is a challenge for most users. Password managers do help however for most users, resetting their password is a common event that adds unnecessary and unwelcome friction to accessing online accounts.
Compliance: MFA can be a chief requirement for complying with specific industry regulations. Many states or local rules already state that organizations should utilize multi-factor authentication under some circumstances. Organizations are required to comply with these regulations to avoid potential fines and minimize audit findings.
2FA Vs. MFA
It is crucial to understand the difference between two-factor authentication and multi-factor authentication. MFA requires two or more authentication factors to verify whether the user accessing the information is authorized or not. Organizations may use different combinations of authentication factors that suit their requirements.
Two-factor authentication is a subset of MFA which uses only two factors for the authentication process. Every two-factor authentication is multi-factor authentication, but every multi-factor authentication is not two-factor authentication. More security layers mean fewer chances of hackers getting through, hence higher security of your data and information. But there is more to be read about the comparison of two-factor authentication vs multi-factor authentication.
MFA in Banking
The benefits of multi-factor authentication extend to the financial industry since it requires powerful security systems to protect the sensitive data and financial assets of their users. Banks and other financial institutions implement multi-factor authentication factors to ensure access to online financial accounts is by authenticated users only.
Securing sensitive information and personal data is essential for all organizations and industries. MFA can help strengthen the security system through multiple layers of authentication factors that protect against unauthorized access.