Do you know about two factor authentication 2FA?

Today, with password leaks, phishing, and account takeover becoming increasingly common, two factor authentication (2FA) has become an important means for individuals and businesses to protect their accounts and systems. It does not require users to give up their passwords, but rather adds an additional verification beyond the password, making it more difficult for attackers to impersonate legitimate users and enter applications, services, or networks even if they obtain the username and password. For organizations looking to enhance their identity security, understanding the definition, verification factors, working methods, common types, and differences between 2FA and multi factor authentication is the foundation for developing security policies.

Two factor authentication (2FA) is a secure process used to enhance the authenticity of a person's identity. This process will require users to provide two different authentication factors before accessing the application or system, rather than just providing a username and password. In the face of increasingly complex network attacks in the cybersecurity environment, 2FA is an important security tool for organizations to protect data and users. Enterprises of all sizes must continuously improve their defense measures as the complexity of attacks increases to prevent malicious attackers from invading their networks and systems. To understand what 2FA is, it's best to remember that it allows organizations to no longer rely solely on passwords to access applications and websites. 2FA, as its name suggests, provides a two-step verification process and an additional layer of protection for businesses. This makes it more difficult for cybercriminals to steal user identities or access their devices and accounts, and also helps organizations prevent attackers from entering the system, even if user passwords have been stolen. This process is increasingly being used to prevent common network threats, such as phishing attacks, where attackers forge identities after stealing target passwords.

There are various factors that can be used to confirm identity. Knowledge factors refer to information that users know, such as passwords, personal identification numbers (PINs), or passwords. The holding factor refers to the things that the user owns, such as a driver's license, ID card, authentication application on mobile devices or smartphones. Attribute factors are related to personal traits or user characteristics, usually in the form of some form of biometric recognition, including fingerprint recognition, facial and speech recognition, as well as behavioral biometric features such as keystrokes and language patterns. The location factor is usually based on the user's location when attempting to verify identity. Organizations can restrict specific devices located in specific locations from attempting identity verification, depending on how and where employees log into their system. The time factor restricts authentication requests to a specific time period, during which users can only log in to the service. All access attempts outside of this time period will be blocked or restricted.

When a user attempts to log in to an application, service, or system, the two factor authentication process begins until the user is granted the appropriate permissions. The user first opens the application or website of the service or system they want to access, and the system will require them to log in with credentials. After the user inputs their login credentials, typically a username and password, the application or website will confirm these details and determine if the correct initial authentication information has been entered. If the application or website does not use password login credentials, a security key will be generated for the user, which will be verified by the authentication tool and the server will validate the initial request. Subsequently, the system will prompt the user to submit a second authentication factor, which is usually the holding factor, that is, something that only the user owns. For example, an application or website may send a unique code to the user's mobile device. The user inputs the code into the application or website, and if the code passes, the user is authenticated and granted system access.

There are several types of 2FA that can be used to further confirm user identity. Some simpler cases include answering security questions and providing one-time codes, while others use various types of tokens and smartphone applications. Hardware token is the initial type of 2FA method. They are usually small key card devices that generate a unique digital code every 30 seconds. When users submit their first verification request, they can view the key card and submit its displayed code. Other forms of hardware tokens include Universal Serial Bus (USB) devices, which automatically transmit authentication codes when plugged into a computer. One example is YubiKey, which stands for Universal Key and is a secure key that allows users to add a second authentication factor to services such as Amazon, Google, Microsoft, and Salesforce. When users log in to services that support one-time password (OTP), such as Github, Gmail, or WordPress, they will use a USB device. The user inserts YubiKey into the USB port, enters the password, clicks on the YubiKey field, and then presses the button on the device. It will generate an OTP containing 44 characters and automatically input it into the user's device for verification by holding 2FA factor. For organizations, the cost of allocating hardware token devices is usually high. In addition, they are easily lost by users and may be hacked, making them an insecure authentication option.

When users attempt to log in to an application or service, they will use short message service (SMS) and text message 2FA factors. SMS messages will be sent to the user's mobile device, containing a unique code that the user subsequently inputs into the application or service. Banks and financial services departments have used such 2FA factors to verify customers' online bank account purchases and changes. However, considering that text messages are easily intercepted, they usually abandon this option. Similar to the SMS factor is voice call 2FA. When users enter their login credentials, they will receive a call on their mobile device, which will inform them of the 2FA code they need to enter. This factor is used less frequently, but organizations in countries or regions with low smartphone usage will deploy this method.

The more commonly used password free two factor authentication is push notifications. Instead of receiving codes on mobile devices via SMS or voice, which could be hacked, users will receive push notifications from secure applications registered on the authentication system's devices. This notification will inform the user of the requested action and remind them that someone has attempted to authenticate their identity. Then, they only need to approve or reject the access request. This authentication method establishes a connection between the application or service that the user is attempting to access, the 2FA service provider, the user themselves, and their device. This approach is easy to use and reduces the likelihood of security risks such as phishing, man in the middle attacks, social engineering, and unauthorized access attempts. This authentication method is more secure than SMS or voice calls, but there are still risks involved. For example, when a push notification appears, users can easily quickly click the approval button and accidentally confirm the identity verification request made by the fraudster.

Smartphones offer various possibilities for 2FA, allowing companies to use the most suitable features for themselves. Some devices can recognize fingerprints. The built-in camera can be used for facial recognition or iris scanning, and the microphone can be used for voice recognition. Smartphones equipped with Global Positioning System (GPS) can verify location as an additional factor. Voice or SMS can also be used as channels for out of band authentication. Trusted phone numbers can be used to receive verification codes through SMS or automated phone calls. Users must verify at least one trusted phone number to register for 2FA. Apple iOS, Google Android, and Windows 10 all have applications that support 2FA, allowing the phone itself to serve as a physical device that satisfies the holding factor. Duo Security, located in Ann Arbor, Michigan, is a 2FA platform provider acquired by Cisco for $2.35 billion in 2018. Its products enable customers to use 2FA with their trusted devices. Duo's platform first verifies whether users are trusted, and then verifies whether mobile devices can be trusted for user authentication.

Identity verification applications have replaced the method of obtaining verification codes through text, voice calls, or email. For example, to access websites or web-based services that support Google Authenticator, users need to enter their username and password, which is the knowledge factor. Then, the system will prompt the user to enter a six digit number. The validator will generate numbers for the user without having to wait for a few seconds to receive a text message. These numbers change every 30 seconds and are different each time you log in. By entering the correct number, users can complete the verification process and prove ownership of the correct device, i.e. holding factor.

2FA belongs to the broad category of Multi Factor Authentication (MFA). MFA requires users to verify multiple identity factors before obtaining service access permissions. This is a core component of any Identity and Access Management (IAM) solution, which can reduce the likelihood of data breaches or network attacks by further verifying the authenticity of user identities. The main difference between 2FA and MFA is that 2FA only requires one additional authentication factor. On the other hand, MFA can use as many authentication factors as possible required by the application to verify the authenticity of user identity. This is because attackers may crack authentication factors such as employees' ID cards or passwords. Therefore, companies must add further authentication factors to make it difficult for hackers to achieve their goals. For example, highly secure environments typically require higher levels of MFA processes, which may combine the use of physical factors, knowledge factors, and biometric verification. Usually, factors such as geographic location, devices in use, duration of service access, and ongoing behavioral verification are also considered. The key to any authentication process is to find a medium that satisfies the end user, is easy to use, and provides the security level required by the enterprise to protect its data and systems. Employees do not want to be hindered by slow and unreliable authentication schemes, and they will inevitably avoid cumbersome processes that hinder the completion of their work.

Essentially, requiring multiple authentication factors before granting users access to applications or websites is more secure than relying solely on username and password combinations. Therefore, 2FA is more secure than a protection method that only requires users to enter a single password. Similarly, MFA can be considered more secure than 2FA because it requires organizations to require users to submit more authentication factors. However, there are flaws in the security aspect of 2FA. For example, when device manufacturers encounter security vulnerabilities, using hardware tokens can make the organization vulnerable to attacks. Security company RSA suffered a data breach in 2011 due to a hacker attack on its SecurID authentication token. Other authentication factors also have their drawbacks. SMS 2FA is inexpensive and convenient for employees to use, but it is vulnerable to network attacks. The National Institute of Standards and Technology (NIST) in the United States does not encourage the use of SMS for 2FA, stating that SMS is vulnerable to various portability attacks and malicious software. However, most cyber attacks come from remote locations, making 2FA a a relatively useful tool for protecting businesses. It typically prevents attackers from accessing applications or systems using stolen user credentials and passwords. Attackers are also unlikely to obtain the user's second authentication factor, especially those involving biometric recognition.

Overall, 2FA is not a foolproof solution, but it significantly increases the security threshold for accounts and systems. For organizations looking to reduce the risks of credential theft, phishing, and account takeover, choosing the appropriate second verification factor and balancing security, user experience, and deployment costs is the most important consideration when implementing 2FA. As attack methods continue to evolve, two factor authentication will remain a fundamental aspect of identity and access management strategies.