In this lesson,
we are going to discuss multifactor authentication.
Multifactor authentication,
commonly referred to as MFA,
is a security system that requires
more than one method of authentication
from independent categories of credentials
to verify the user's identity.
The goal of multifactor authentication
is to create a layered defense and make it more difficult
for an unauthorized person to access a target,
such as a physical location, computing device,
network, or database.
Multifactor authentication revolves around the concept
of combining at least two or more independent credentials
from across five different categories of authentication,
including something you know, or a knowledge-based factor,
something you have, or a possession-based factor,
something you are, or an inherence-based factor,
something you do, or a behavior-based factor,
and somewhere you are, or a location-based factor.
First, we have something that you know.
This is also known as a knowledge-based factor.
Something you know involves knowledge-based information
that the user must provide to authenticate their identity,
such as a password or a PIN,
or answer some secret question about the user,
like their pet's name.
For example, when you try to unlock your iPhone
using the six-digit PIN, you are using something you know
or a knowledge-based factor.
Second, we have something you have,
also known as possession-based factor.
Something you have involves
something the user physically possesses,
like a smart card or a hardware token, like a key fob,
or a software token used with your smartphone.
A smart card is an identification card
about the size of a credit card
that is embedded with an integrated circuit
that can process data to authenticate a user
in a high security access system.
When I used to work for the US government,
I was issued a smart card,
which acted as my employee identification badge.
I would insert this smart card into my laptop
and enter a six to eight digit PIN to unlock smart card,
and this in turn would unlock my laptop
to let me begin my workday.
In this setup, the smart card was the possession factor
and the PIN was a knowledge factor,
so using the smart card and PIN
created a pretty secure multifactor authentication
or two-factor authentication system.
A hardware token, also known as a key fob,
is a physical device used for securing access
by generating a unique code that is then typically used
within a multifactor authentication system.
These portable devices enhance security
by creating a rapidly changing code
that is sent to the user every 30 to 60 seconds
during the authentication process.
This user must provide the code,
in addition to their regular login credentials,
to ensure that the person who is attempting to gain access
actually possesses the correct physical device.
This significantly reduces the likelihood
of unauthorized access through stolen credentials,
since the attacker would also need to be in possession
of the hardware token in order to access the given system.
Another commonly used type of hardware token
is a USB-based hardware token
that contains a digital private key certificate
that can be used during the authentication process.
With these types of hardware keys,
you simply need to have the device connected
to your workstation or laptop during the login process.
The digital certificate located on the hardware token
is checked as part of your possession factor
authentication process.
A software token or a soft token
is used to perform the same function as a hardware token,
but don't require a dedicated piece of hardware,
like a smart card, key fob, or USB hardware token.
Instead, a software token, or soft tokens,
are typically configured as an application
or a piece of software that's installed on an device
that the user already possesses, like their smartphone,
tablet, smartwatch, laptop, or desktop computer.
When the user attempts to log in,
the software token software will generate a one-time code
that the user enters during the authentication process.
Like hardware tokens, these codes are typically time-based
and will change every 30 to 60 seconds.
Generally, software tokens will take two forms,
an authenticator app
or an SMS-based one-time-code-use token.
Authenticator apps like Google Authenticator
or Microsoft Authenticator can be used
to generate time-based, one-time passcodes
for use in the authentication process
for most websites or applications.
These authenticator apps
work exactly like the hardware token key fobs
we just discussed, but use a software authenticator app
that allows for cheaper and faster deployments
to your user located across your enterprise network.
The second type of software token
relies on using your smartphone
as the token receiving system itself
by sending you a one-time code
to the user's registered phone number or email address.
In this system, the SMS-based message is received
with a one-time code that is then valid
for between three to 10 minutes.
During that time,
the user must enter their login credentials,
which is something they know, and this one-time code,
which is now considered something they have,
or possession factor, since they had to have the phone
to receive that one-time code.
Using either a hardware or a software token
can provide an extra layer of security
in the multifactor authentication system.
The specific choice between using a hardware
or software token would depend on the specific needs
and resources of your organization.
Third on the list is something you are,
also known as inherence-based factor.
Something you are involves biometric characteristics
that are unique to individuals, including fingerprints,
facial recognition, voice recognition, or iris scans.
Older iPhones, for example, rely on a fingerprint scan
to unlock a user's smartphone.
According to Apple, there's a one in 50,000 chance
that another person's finger could be used
to unlock your iPhone
because their systems are tuned pretty well
to prevent a false acceptance.
But using a Face ID system is even better
and has been widely used for about the last five years now.
If you use a modern smartphone,
like an Apple iPhone or an Android phone,
you probably use biometrics to unlock your phone
on a daily basis by using a facial recognition scan.
With Apple's Face ID, for example,
you can simply look at the front-facing camera
whenever you want to unlock your phone,
and the phone will then use the TrueDepth camera
to capture a new image in depth map,
which is then analyzed by a neural engine
inside of the phone that compares this newly taken image
against the biometric facial data
already stored on the phone.
If the image and the stored data match,
then the device will unlock itself.
With Face ID, Apple claims that the probability
that another person's face will unlock your iPhone
is approximately one in a million,
making it about 20 times more secure
than a former fingerprint-based authentication system
used in older models of the iPhone.
In recent years, biometric factors
have rapidly increased in their utilization,
especially with multifactor authentication systems,
due to the advancements
of this type of authentication technology
and its inherent difficulty
in replicating someone's biometric authentication data.
Fourth, we have somewhere you are,
also known as a location-based factor.
Somewhere you are involves determining a user's location
to help authenticate them.
This could be done through IP address verification,
GPS tracking, or by connecting to a specific network.
For example, access points may be restricted to a user
within a specific geographical location,
such as allowing someone to log into a given website
only if they're located outside of the United States.
Fifth, we have something you do,
also known as a behavior-based factor.
Something you do involves recognizing patterns
that are typically associated with a user,
such as their keystroke patterns, mouse movement,
or even the way they walk down the hallway.
Something you do is considered one of the newer categories
that are used in multifactor authentication systems,
and something you do is often used
as a secondary factor in authentication systems
and is rarely used in a single-factor authentication system.
Another example of behavior-based factors
could be the way someone interacts with an device,
such as their specific pattern of swiping, scrolling,
or even the way they hold their device.
These unique behavior patterns
can then be used to create a profile
that helps authenticate the user's identity.
Now, when it comes to authentication,
we have three main types,
single-factor, two-factor, and multifactor.
Single-factor authentication
involves using a single authentication factor
to access a user account.
For example, if you simply enter your username and password
to log into the website,
that is a single-factor authentication.
Now, wait a minute.
Isn't the username one factor
and the password a second factor,
so wouldn't this be considered two-factor authentication?
Well, no, because both of those are something you know
or knowledge-based factors.
Even if I added a security question
after you enter your username and password,
like asking you your first pet's name
or the high school mascot,
this is still considered a single-factor authentication
because all three pieces of authentication data,
your username, your password,
and the answer to your security question,
are considered to be knowledge-based factors.
This brings us to our next type of authentication,
which is two-factor authentication.
Two-factor authentication, also known as 2FA,
involves using two different authentication factors
to gain access to a system.
So, if you enter your username and password
as part of the authentication process,
that will be the first factor.
Then, if you are sending a text message to your smartphone
with a random six-digit code, that will be a second factor,
since this is a possession factor,
proving that you have your smartphone with you.
Now we have 2FA or two-factor authentication,
since we're required to enter our knowledge-based factor
and then provide our possession-based factor,
giving us two factors of authentication.
Now, if you have two factors,
you may also hear this called multifactor authentication.
Multifactor authentication occurs whenever you use two
or more factors to authenticate within a given system.
So, 2FA is actually considered MFA as well,
but it is a specific type of MFA, since MFA can use two,
three, four, or five factors for authentication.
As a basic rule, the more types of authentication
that you use to validate a user,
the safer your system will be.
But conversely, the more factors you require,
the harder it is for your end users
to gain access to the system
in order to complete their work,
making this a security versus convenience trade-off.
For this reason, most companies
will use multifactor authentication systems
using two or three factors, something you know,
something you have,
or something you know, something you are,
something you have, and somewhere you are.
As you have probably guessed
the most commonly used authentication factor
is knowledge-based authentication factor,
like passwords and PINs.
Passwords have been a fundamental part
of security for a long time, but they often pose challenges
for both our users and our developers.
Remembering a lot of different complex passwords
can be difficult tasks for most users,
so this leads to many simply using weaker
and easy to remember passwords,
or reusing the same long, strong password
across multiple websites, which in turn
removes most of the security benefits
of having that long, strong password to begin with.
Many users will also use a password manager
like Bitwarden or even a built-in password manager,
like the one provided in Google Chrome,
which is called the Google Password Manager.
These password managers can generate different
long, strong, and complex password for each website
or application that you use,
and then it will store these passwords safely
in a centralized vault that's encrypted
using a single long, strong password that you created.
Personally, I found this to be an effective way
to maintain high security when using a password-based system
without having to remember 300-plus passwords.
In reality, though, the use of password managers
to create unique passwords does increase our security a bit,
but passwords in general still inherently lack
a lot of the robust security that we want to achieve.
To increase our security,
we may opt to use multifactor authentication,
but this will introduce additional steps
that the user must take when logging into the system,
and it increases our overall cost
to implement an authentication solution.
Fortunately, there is now a valid alternative
to using passwords for authentication,
and this brings us to the world of passkeys.
Passkeys are the next evolutionary step
towards passwordless authentication,
and they can offer us a simpler,
more secure cross-device authentication method,
where users can create and access online accounts
without needing to input a password.
With passkeys, the browser or operating system
prompts users to create a passkey.
Users then simply use their device's lock screen,
like a fingerprint sensor or facial recognition scan,
to secure these passkeys, which eliminates the need to type
or remember anything during the authentication process.
Instead, when the user wants to log in,
they are simply prompted to unlock the device
using their preferred authentication factor,
like a facial scan or a fingerprint,
depending on the type of device being used.
Many websites and apps have already adopted
the use of passkeys, and they are already reporting
that they're seeing multiple benefits,
including increased login success rates,
lower drop-off rates, improved conversion rates,
and reduced costs associated
with separate multifactor authentication solutions.
Passkeys offer more robust protection
against phishing and data breaches as well,
which is important, since these are probably
the two most significant security threats
that passwords fail to mitigate against.
Passkeys utilize public key cryptography,
with the private key securely stored on the user's device
and created using the screen lock functionality
and the user's fingerprint, facial recognition,
PIN or unlock pattern.
The corresponding public key is stored
on the authentication server.
Since there are no secrets on the server,
only the public keys,
these passkeys are not acceptable to compromise
if the server is breached by an attacker.
Also, each passkey is unique
to the service it was created for, so this prevents users
from being misled into using their stored passkeys
on malicious websites or applications.
So remember, multifactor authentication methods
provide a higher level of security
than single-factor authentication methods.
Authentication factors are crucial
in validating a user's identity,
and various methods offer us different layers of security.
Something you know refers to a piece of information
only the user should know, like a password or a PIN.
Something you have involves the physical device
that a user possesses,
such as a smartphone receiving a verification code
or a hardware token like a key fob.
Something you are encompasses biometrics,
which are unique physical characteristics of a user
that are used to verify identity,
including fingerprints or retina scans.
Something you do captures the unique behavior of a user,
like signature dynamics or keystroke patterns.
Lastly, somewhere you are leverages the user's location
as an authentication mechanism to restrict access
to specific services unless the user's geographic location,
often determined through GPS or IP address,
matches the expected area.
Each factor contributes to a holistic approach to security
and ensures that your authentication systems
are robust and multi-dimensional.
Implementing multifactor authentication systems
makes it harder for unauthorized users to attack
or to gain access
to your organization's information systems or data.