Tag Archive for: Authentication

Ways to Implement Multifactor Authentication Without a Mobile Device

/in


Passwords are hard to remember and even harder to change periodically, and it’s increasingly difficult to devise strong credentials. Instead of confronting the challenge, many users rely on weak passwords and reuse them for multiple accounts. This makes it easy for cybercriminals to guess credentials or obtain them via phishing attacks.

Once gathered, credentials can be sold on the dark web. Then, both the original criminal and hordes of other attackers can gain access to personal and work-related systems and data.

Two-factor authentication (2FA) and multifactor authentication (MFA) are accepted ways to make credentials much less vulnerable. 2FA relies on a combination of something you know (e.g., username/password) and something you have (e.g., your mobile phone or computer, a keycard or a USB) or something you are (e.g., a scan of your iris or fingerprint) to ensure that only authorized individuals can access sensitive systems and information.

MFA can involve all three factors. With MFA, even if the username/password combination is stolen, accessing an account is extremely difficult because criminals won’t be able to complete the additional authentication steps.

Click the banner to access customized content when you register as an Insider.

When MFA and Mobile Devices Don’t Mix

Common methods of implementing MFA often rely on the use of mobile devices. When an SMS message, a one-time password or a push notification is sent, it is commonly delivered to a user’s smartphone. That said, there are some risks associated with sending SMS, one-time password or push notifications for MFA. When implemented improperly or as the sole security method, messages could be hacked and codes intercepted. In fact, the U.S. government has recommended that no MFA solution should rely solely on SMS verification tools.

Ensuring Protection Outside of Mobile-Based MFA

To fill these gaps and ensure 100 percent MFA coverage, agencies may consider hardware security keys. The key is typically a physical device, often a USB drive that only grants access to accounts while it is plugged into a computer. It provides a high level of protection against phishing and hacking because no…

Source…

Federated Authentication vs. SSO: What’s the Difference?

/in


If you’ve ever deployed a new application for your organization, you know first-hand the grumbling and security headaches that can come with it. It’s one more sign-on and password for your users to remember (or – more likely – write on a post-it and leave in their desk drawer for anyone to stumble across).

Did you know that over 40% of employees have admitted to using the same two to four passwords for all of their accounts? Even if you try to combat this with 90-day password requirements, it usually ends with numbered variations of the same password, which is a security nightmare.

So how can you combat password fatigue and poor security practices without putting the onus on your users? That’s where tools like federated authentication and single sign-on (SSO) come in. These authentication methods streamline the sign-in process and make it easier for your users to access the necessary applications and sites.

Which one is right for your organization? Read on to learn more about federated authentication vs. SSO and what implications the nuances between them have for your organization.

What Is Federated Authentication?

Federated authentication, or federated identity management (FIM), is a model of authentication developed to address an early problem of the internet where users on one domain could not access information from other domains. This was especially difficult for organizations whose operations were spread across multiple domains. It created a very disjointed and frustrating user experience.

FIM was developed as a solution to this problem. It started as a list of agreements and standards that allowed organizations to share user identities. This is the type of agreement that allows you to sign-in to Paramount Plus with your Amazon account or into Spotify with your Google account information.

But no matter where you’re signing in or with which credentials, it’s not the applications themselves that are reviewing or authenticating user credentials. Instead, an identity provider (IdP) reviews them and validates (or doesn’t). This often requires the use of open-sourced Security Assertion Markup Language like OAuth or OpenID Connect. These are open standards that…

Source…