Five things to consider before choosing an MFA solution
Because we all should move on from using “password” as a password!
Ever since anyone had cause to use a computer, passwords have been the mainstay of secure access to resources. It turns out, however, that passwords aren’t as secure as we once thought.
They can be guessed or cracked easily, stored insecurely, and traded online by nefarious cyber criminals. This means the world is inevitably moving towards using multifactor authentication (MFA) as a more secure means of authenticating your identity and accessing your critical information.
MFA adds an extra step to the authentication process. In addition to what a user knows, such as their username and password, MFA pairs this process with an action; this could be a code sent through an SMS message or email, or a token delivered through an authentication app.
It's becoming far more prevalent these days. If you've tried to access your bank account details online, or have bought something from an online retailer, you'll probably get an SMS sent to your phone with a code you need to input before you can proceed further, in order to access your account.
So, with MFA fast becoming commonplace, and for good reason, it's now required to meet compliance requirements in some industries. What should you consider when selecting an MFA solution? There are five factors to contemplate.
Flexibility: Does the MFA solution apply only the required amount of security depending on what risk is posed by who's accessing the resources? Also, does the solution offer flexible ways of authenticating users? Will it offer hardware tokens, such as a USB-based dongle, or software tokens, such as smartphone app to NFC to text message and push notification? Does it allow users to use biometrics, such as fingerprint scans or facial recognition?
Costs: There's a cost to implementing MFA, which are down to what option your organisation chooses to implement. Hardware tokens, for example, have deployment and recurring costs, such as server infrastructure, staffing, vendor support, and hardware production and distribution. There are also costs involved with software tokens, although these tend to have fewer deployment costs, and implementation can be achieved in weeks.
Security: When implementing an MFA, there are diverse levels of security that can be used. Passwords and PINs are less secure than hardware tokens or a FIDO authenticator, which can be used when an organisation needs phishing-resistant authentication that can roam between devices. One-time codes offer high security when users don’t have a dedicated authentication app, meanwhile. Push notifications, too, can be a good choice if your users can use a mobile authentication app. Biometric authentication, finally, is good for system logins or specific apps.
Scalability: Any MFA implementation your organisation opts for needs to be scalable so it can be deployed across your whole organisation, and develop as the business grows. This means security practices should be consistent across the organisation. Deployment should cover all end-users, whether they're in the office or working remotely. MFA should also cover cloud and on-premises applications, VPN, server logins, and privilege elevation.
Ease of use: MFA should not only be easy to roll out, but should be easy to use. Some users may be limited in what they have as another factor to log into resources, such as lacking a smartphone or being unable to use a hardware token. Organisations need to balance usability with cost and security to increase acceptance.
Join the 90% of enterprises accelerating to the cloud
Business transformation through digital modernisationFree Download
Delivering on demand: Momentum builds toward flexible IT
A modern digital workplace strategyFree download
Modernise the workforce experience
Actionable insights and an optimised experience for both IT and end usersFree Download
The digital workplace roadmap
A leader's guide to strategy and successFree Download