Multi-factor Authentication (MFA) is an authentication method that requires the user to provide two or more credentials in order to gain access to an account. Rather than just asking for a username and password, MFA requires one or more additional verification factors, which decreases the likelihood of a threat actor taking over an account.
Picture yourself at an ATM withdrawing money from your bank account. Your debit card (something you have) is one authentication factor. However, to access your account, you also need to enter the PIN that is associated with your debit card. Your PIN (something you know) is your second authentication factor.
Another common example nowadays is with access controls for online banking. In order to log into your online bank account from a new device, you must provide your username and password (something you know) along with another factor, such as a one-time passcode on an authentication app on your cell phone (something you have). As cellphones incorporate biometric information, facial recognition (something you are) may be that additional factor.
Modern MFA does not include static authentication methods such as; certificates or pre-shared keys (PSK). Using certificates or pre-shared keys in conjunction with a set of credentials does not satisfy MFA requirements as underlined by National Institute of Standards and Technology (NIST). Certificates and pre-shared keys are both forms of the same factor. MFA requires the use of multiple factors categories - not more of the same one.
Pro-tip: The recommended MFA solution has a unique code for each use and is individual to you as a user.
Account takeovers have accounted for 81 percent of data breaches in recent years. There are limits to what a single password can do. Rather than asking for a single password that hackers and cyber criminals can gain access to, this adds an additional layer of security. MFA helps protect against unauthorized access, data breaches, and password-based cyber-attacks.
At Corvus, we require MFA implementation for remote access, email access, and administrative access. We like to see that companies have secured any remote access points to their data or systems with MFA, as well as the use of privileged accounts internally, such as domain admins. We’ll detail the specifics below:
Threat actors commonly target user credentials to then login to their email accounts and gain full control of that user’s email.
Some examples include: RDP, VPN, messaging apps, or your HR software. Threat actors will commonly scan for remote access technologies to login with stolen credentials or brute force accounts with weak passwords.
MFA should also be implemented for administrator account usage inside of your network. Administrative accounts, or privileged accounts, are accounts that give full access to a system like local administrator accounts and domain administrator accounts -- these are the accounts that threat actors target so protecting them is critical. MFA for administrative accounts is typically enforced for interactive logons such as RDP or terminal connections like SSH.
However, we do recommend that there are other cybersecurity best practices, such as leveraging a Privileged Account Management (PAM) solution to manage those, and all, privileged accounts.
Cybersecurity professionals have long advocated that two-factor authentication utilizing text messages (SMS) is less secure than other methods. The US government stopped using SMS authentication in 2016 — and encouraged others to do the same. Since then, there have been successful breaches across organizations that still utilize this less secure variation of MFA.
There are countless ways for criminals to bypass SMS authentication, some more complex than others, but opt for utilizing MFA apps like Duo and Google Authentication if you’re using a smartphone as a means to enable MFA for your organization.
Another example is key or certificate based authentication in which a digital certificate installed on a laptop or a “key” is placed on a system. While these can be used with a password, they are within the same factor category.
MFA is an important preventive measure to take to avoid security breaches, but it is not an all-encompassing solution to protect an organization. As noted above, there are weaknesses with SMS-based authentication — and even the most secure forms of MFA have limitations.
For example, if an employee’s personal computer was already compromised and they were utilizing a VPN to work from home, MFA may not prevent malware spreading throughout the corporate network. Additional external and internal defenses would be necessary for further risk mitigation.
While cost can be what holds some back from adding further security measures, MFA is an affordable option to further protect your organization. Notably, through O365 and Google Workspace, there are no additional costs to implement multi-factor authentication. For smaller organizations with fewer users, this is a great starting point. As you grow, you may want to unlock additional features, and moving to an enterprise solution such as DUO or Okta is a great next step and unlocks additional security and monitoring features.
(Optional after deploying second factor)
Pins are usually static and typically a numeric or alphanumeric string of characters.
Some may require a user to plug it into a computer whereas others generate a sequence of numbers as the 2nd authentication.
For example, mobile apps will allow you to login with your fingerprint instead of your password.
This is a main implementation method for physical hardware keys.
This allows users to log in to mobile and web applications using biometrics, mobile applications, or FIDO U2F keys.
The one time code is valid until a new code is generated.
This is used in lieu of a OTP.
Major email providers like Microsoft 365 and Google Gmail have a free MFA solution, regardless of the subscription level purchased.
Enterprise MFA solutions, such as DUO or Okta, allow organizations additional controls and features for a paid plan.
First determine whether the remote access solution or cloud provider has integrates with the free solutions offered through Microsoft or GSuite. If not, they will need to identify an MFA tool that integrates with their software or hardware, such as DUO or Okta. Most cloud software supports a free MFA solution that just need to be turned on, especially software being used to store sensitive data (such as Electronic Medical Records software and HR software). Integration with enterprise MFA solutions will be dependent on the cloud provider’s ability to integrate with other technologies.
You should determine if there are any free MFA solutions available for the admin credentials. This however is less likely, especially if they are a hybrid, on- premise and cloud environment, and they may need to identify an MFA solution such as DUO or Okta. Some solutions can integrate directly into Active Directory to support enterprise wide MFA for administrator accounts. For environments with fewer systems, MFA can be enforced on a system by system basis.
___________________________________________________________________
Links in this Article & Additional Resources
The Importance of MFA (Tetra Defense)
Not all Two-Factor Authentication is Created Equal (LMG Security)
Microsoft Office 365 Security Best Practices to Protect Your Organization (LMG Security)
The Importance of Multi Factor Authentication in Cybersecurity (Veridium)
MFA Best Practices (Centrify)