Introduction
The last thing we want is to give an unknown hacker access to our private online accounts. There are so many potential ways that this can harm us.
For example, an attacker could use the information to steal our identity and try to open bank accounts or get credit cards in our name. If the attacker can access our bank account directly, they could transfer money to their own fraudulent accounts and run off into the sunset with our hard-earned cash. A stolen account can even allow an attacker to target our contacts such as our friends, family, and business contacts.
Another important factor is that remembering hundreds of unique passwords is impossible and so, let’s be honest, we tend to use the same password on multiple websites. We know we shouldn’t but do anyway!
If you want more information about how a password manager can help make creating and using a unique password super easy, check out our article about password managers!
Nobody wants these nightmarish outcomes to become a reality so let’s learn about how multi-factor authentication (MFA) is an exceptional solution to protect our online activity.
And if you are a website designer – how you can maintain a good reputation by protecting your users and being a tech superhero!
What is Multi-Factor Authentication (MFA)?
MFA is a security process that requires more than one method of authentication to verify a user’s identity before they are given access to an account or service. MFA is important because it helps keep your online accounts safe from hackers and other types of digital pirates such as script kiddies that seek to do your harm.
Sometimes MFA is an option that can be enabled by the user and sometimes MFA is part of a mandatory policy defined by managers to meet an organization’s mandatory risk requirements.
Think of it like this: MFA is like adding an electric fence around your online accounts that prevents a hacker from wreaking havoc on your personal and financial information.
Entering an extra code or quickly scanning your fingerprint every now and then is a small price to pay for bulletproof security. Plus, it’s a great opportunity to show off your tech skills and impress your friends with your advanced security measures.
There are three main types of authentication and employing any combination of these methods can be described as MFA. The three main types of authentication commonly used for MFA include:
- something the user knows,
- something the user has, and
- something the user is.
We will learn what each of these three types of authentication is a little later in the article. For now, it’s good enough to know that MFA uses more than one type of authentication.
How Does MFA Work?
Users are typically asked to provide their username and password when logging into their accounts. It’s a simple one-step process and you are in. It’s quick and easy, and everyone is used to this method.
However, there are some serious problems with that simple approach. It’s too easy and does not provide enough security. When you consider that our accounts contain loads of personal data about us and may even provide direct access to our money or authorized payments, we need to increase our security.
If a hacker has stolen or otherwise gained access to a user’s password, MFA helps protect the account against unauthorized access and makes it more difficult for hackers to gain access to sensitive information.
What Is the Purpose of MFA?
The purpose of MFA is to increase the security of a user’s online or software application account. With MFA, a user is required to provide more than one form of evidence in order to be given access.
This is so important because if a user’s online account is breached by an attacker, there are several potential consequences that could occur:
- Money or cryptocoin theft: If an attacker gains access to an account such as an online banking site, PayPal account, cryptocoin exchange, or another site with payment access such as Amazon, the attacker could steal money from the victim by transferring the money to another account, or making fraudulent purchases. In these cases, the attacker will use other fraudulent accounts set up with stolen identity information to make sure they don’t get caught.
- Personal information theft: The attacker could gain access to sensitive personal information such as the user’s name, address, date of birth, and financial information. This information could be used for identity theft or fraud.
- Account takeover: The attacker could take control of the user’s account and use it for their own purposes. This could include sending spam or malicious emails to trick new victims, making purchases, or accessing other accounts linked to the user’s account. Once they gain access, they will likely change your password and the email address associated with the account. In that case, you may have a long road ahead of you to contact the site owner and prove that you actually own the account.
- Damage to reputation: The attacker could post inappropriate or damaging content using the user’s account, which could harm the user’s reputation or relationships. Nobody wants to look like an easy victim, so it’s better to use MFA to protect yourself. If you are a business, your partners and clients will not be impressed by your lack of security, and they may stop doing business with you.
- Legal consequences: Depending on the nature of the attack and the information accessed, the user may face legal consequences, such as fines or criminal charges. Although this is unlikely for the average user, website operators have legal responsibilities to their users, and in some cases, they can be fined for not protecting their data.
Considering these terrible consequences, it’s important for users to take steps to protect their online accounts and to be aware of the potential consequences of a breach.
This includes using strong and unique passwords, enabling MFA when available, and being cautious when clicking on links or downloading attachments from unfamiliar sources.
What are the different types of MFA?
So let’s quickly learn the different types of authentication that are involved in MFA. Remember, MFA must use more than one of these to be truly considered MFA.
Something you know (knowledge)
This factor involves information that the user knows, such as a password, a security question, or passcode or PIN number. A password is the most commonly used “first factor” in most online and software application authentication.
However, sometimes other forms of “something you know” are used such as a question that the user is asked to configure beforehand or contextual security questions that only the authentic user should know.
Some examples of predefined security questions are “What is the name of your high school?”, “What is your favorite movie?”, or “What is your mother’s maiden name?”. A contextual question may ask the user “When was the last time you logged on?” or “How much money was the last transaction you made?”
Something you have (possession)
The “Something you have” factor involves a physical object that the user possesses, such as a security token, a smartphone, or a key fob.
“Something you have” MFA adds a significant amount of security to the authentication process because an attacker would need to have possession of the user’s device. If that’s a mobile phone, the screen protection must also be unlocked to access the MFA app.
Here are some physical devices that are often used by “something you have” MFA:
- Security token: A security token is a physical device that generates a one-time code or a secure access token. The user must enter the code or token in order to gain access.
- Smartphone: A smartphone can be used as an MFA factor by requiring the user to receive and enter a one-time code that is sent via text message or an app.
- Key fob: A key fob is a small device that generates a one-time code or a secure access token. The user must enter the code or token in order to gain access.
- Scan a QR code: Some websites and applications allow you to simply scan a QR code on the screen with a special MFA app to sign in.
Something you are (inherence)
The “Something you are” factor involves a physical characteristic of the user, such as a fingerprint, facial recognition, or voice recognition.
These systems all use advanced digital analysis technology to determine the difference between the real user and other people. Some examples of “something you are” MFA include:
- Fingerprint scanning: A fingerprint is a unique pattern of ridges and valleys on the surface of a finger. Some devices have a fingerprint scanner that allows the user to authenticate their identity by touching the scanner with their finger.
- Facial recognition: Facial recognition technology uses algorithms to analyze and compare the unique characteristics of a person’s face, such as the distance between the eyes and the shape of the jawline. This can be used to authenticate a user’s identity.
- Voice recognition: Voice recognition technology uses algorithms to analyze and compare the unique characteristics of a person’s voice, such as pitch, tone, and accent. This can be used to authenticate a user’s identity.
The effectiveness of a biometric technology refers to how well it is able to authenticate genuine users and distinguish between genuine users and impostors. The effectiveness can be measured using some statistical metrics to ensure the biometric scanning technology is good enough to protect users.
These statistics used to determine a biometric technologies effectiveness include:
- False acceptance rate (FAR): The false acceptance rate is the probability that the biometric system will fail by incorrectly authenticating an impostor as a genuine user. A low FAR indicates that the system is able to correctly distinguish between genuine users and impostors.
- False rejection rate (FRR): The false rejection rate is the probability that the biometric system will fail by incorrectly rejecting a genuine user as an impostor. A low FRR indicates that the system is able to correctly authenticate genuine users.
- Crossover error rate (CER): The crossover error rate is the point at which the FAR and FRR meet on a graph. The CER is a measure of the overall accuracy of the biometric system. A system with a low CER is more accurate than a system with a high CER. CER is also known as the Equal Error Rate (EER)
Requiring the user to submit a physical characteristic that they possess is a very effective way to increase the security of the authentication process by preventing an attacker from accessing a user’s account, even if they have obtained the username and password.
Top 7 Reasons For Small Businesses To Use MFA
Now that we understand what MFA is and the various types of MFA that are commonly used to protect users’ accounts, let’s take a more in depth look at why we should use MFA whenever possible on our accounts.
Also, if you are a website or application developer, this section will help you understand why it’s worthwhile to make MFA available to your users by adding the feature to your platform.
1. Improved Overall Security
The most basic fact is that MFA improves the overall security of a website or app. For some people that is enough motivation to simply configure MFA to protect their accounts.
However, if you need more convincing, here are some specific examples of where MFA will add protection:
Protect against brute force attacks
Even if an attacker is able to guess a user’s password, MFA adds an additional step required to log in. So, an attacker would need to not only guess the password but also correctly complete the MFA challenge in order to break into the account.
Protect an internal network
MFA can be configured on individual endpoints and services within a local area network (LAN) which can effectively prevent an attacker from extending their attack using a tactic known as “lateral movement” or “pivoting”.
This is when an attacker who has successfully compromised one computer will attempt to communicate with other systems on the same network and also compromise those systems. Attackers do this to find higher value information that belongs to the victim.
Another tactic that MFA can protect against is “privilege escalation”. This is where an attacker will try to access an administrator account that has permission to perform more sensitive actions. MFA can be used to protect accounts that have more power, preventing an attacker from gaining access to them.
Protects online and cloud accounts
Adding MFA protection to online and cloud accounts also helps protect them against an attacker.
Considering that many companies are increasingly using cloud-based resources such as VPS, managed services such as email, file sharing, and tools for communication and collaboration, an organization also has more risk placed in the cloud. Adding MFA is one way to reduce that risk by adding an extra layer of protection.
2. Meeting Compliance Requirements
Many companies seek IT security compliance to demonstrate to their customers, regulators, and other stakeholders that they have implemented strong security controls to protect the confidentiality, integrity, and availability of sensitive systems and data.
It is critical for organizations to prove to their partners that they are prepared to survive a cyber attack and keep their business operations going.
Compliance standards like SOC-2, PCI-DSS, ISO-27001, and NIST Cyber Security Framework (CSF) and regulatory requirements such as GDPR and CCPA require sophisticated security policies and MFA is often a key requirement.
For example, PCI-DSS requires MFA to be implemented to prevent unauthorized users from accessing systems that contain sensitive payment card numbers and transaction data. If companies that handle payment transactions do not comply, they can be denied service by banks that process the payments.
3. Improving Return On Security Investment (ROSI)
Return on Security Investment (ROSI) is a way to measure how much an organization is getting back from the money they spend on security.
To calculate ROSI, you divide the expected cost benefits of security (like protecting against data breaches and making customers trust the company more) by the costs of security (like buying technology, paying security team members salary, and the cost of time spent researching security related topics such as this article itself).
The result of this calculation shows how much the company is getting back for every dollar they spend on security. A high ROSI means the benefits are worth more than the costs and a low ROSI means the costs are worth more than the benefits.
Because MFA is almost always a free service, the associated costs may only include the time required to create a policy for your company’s employees, and configuring MFA for all users.
The expected savings from using MFA are exceptionally high because the costs of a data breach can cost the company millions of dollars. Because MFA greatly improves security for very little cost it represents a very high ROSI.
For companies that offer services through a website, MFA can reduce costs associated with security breaches. MFA protection for your user’s accounts reduces the number of hacking incidents and the amount of customer service you will need to provide to fix account breaches. Again, because MFA can reduce costs, it improves ROSI.
4. Protecting Against Phishing Attacks
In a phishing attack, an attacker typically tries to trick the user into revealing their login credentials (such as a username and password) by sending them a fake email or link that appears to be from a legitimate source.
If the user falls for the trick and enters their login credentials, the attacker can use them to gain access to the user’s account. However, if MFA is enabled on the user’s account, the attacker would need to not only obtain the user’s login credentials, but also successfully authenticate using one or more additional forms of authentication.
Almost all forms of MFA are impossible to break (such as physical security token, and biometric scanning). For MFA that requires a one-time code from a smartphone app, even if the attacker can trick the user into sending the code, they would only have a few seconds to use it before it expires.
5. Protecting Your Customers Against Cyber-Attack
It is important to make customers feel safe because it can lead to increased customer satisfaction and loyalty. A sense of safety can also encourage customers to continue using a product or service, which can ultimately benefit the company’s bottom line.
When a user’s account gets hacked, they may also feel let down by the company which can lead to reputation damage for the company.
One problem with protecting user’s accounts is that users often reuse passwords between websites. Users get “password fatigue” trying to keep track of so many unique and strong passwords.
So, if another website or service they use is breached by a hacker, the passwords they use can become a weapon against their other accounts. So, to protect your users is to protect yourself. MFA is a powerful tool to make that goal a reality.
6. Reducing Brute Force Attacks
MFA is like a high-tech version of insect repellant for hackers that want to break into your account and steal your data. When attackers discover that an account is protected with MFA, they are going to give up and move on to a victim with less protection.
So, they are unlikely to try brute force attacks against a website that uses MFA because the challenge is exponentially more difficult when MFA is used. So go ahead and spray some MFA on your website accounts and send those pesky mosquito hackers running in the other direction.
7. MFA is easy to use
Passwords are a headache to remember. Are all forms of authentication as tedious and difficult? Well, hopefully not in the future.
Various types of MFA are available, and some of them don’t require much effort. For example, an MFA token delivered to your device is as easy as opening an app on your smartphone and punching in a 6-digit code found in the app. Some methods are even easier than that!
More new forms of “something you have” include scanning a QR code on the computer screen with your phone, or plugging in a small device into the USB port on your computer. Advanced forms of “something you are” solutions are pretty easy too.
You can just scan your fingerprint on the smartphone’s home button or use your phone’s camera to verify your biometric information.
In the not-so-distant future, passwords will be a thing of the past. MFA to the rescue!
Conclusion
MFA is like asking a dragon to stand in front of the door to your online account and ask for additional proof that it’s really you trying to enter.
“Hackers, beware! With MFA on our side, we’re like a well-guarded fortress – good luck getting through that!”.
There are several common types of MFA: something you know, something you have, and something you are, and each type has its own benefits and drawbacks. Also, as technology advances, implementing MFA is becoming easier and using it is becoming simple and seamless.
Companies can also save themselves a lot of money because MFA reduces the costs of dealing with data breaches from phishing attacks, annoying brute-force attacks, and providing customer support to users who’ve had their accounts hacked into.
MFA can also prove to your potential business partners that you take security seriously – winning you more business.
So go ahead and turn on MFA for all your accounts! Your digital assets will thank you.
