What is multi-factor authentication?
Multi-factor authentication (MFA) is a digital method of identification that requires users to go through two or more steps in order to login to an account or application. The first step is usually a password, followed by another form of identity verification.
The goal of MFA is to make it more difficult for hackers or cybercriminals to gain access to these accounts or applications, as it becomes harder to guess additional login details beyond a username and password. This is especially the case with biometric data like fingerprints or facial recognition.
While using multi-factor authentication software on any application or account is beneficial for protecting user identities, the most common usage for this type of login is on anything that contains personal identifiable information (PII) like medical records or banking details. A subtype of MFA, two-factor authentication (2FA) is commonly used in these applications.
Types of multi-factor authentication
As MFA is based on the ability to identify who is trying to log in to an account or application, three types of verification can happen.
- Something the user knows. This type of authentication is based on information a user has knowledge of. For example, this could be a password, PIN, or answers to security questions that can be manually entered at login. These are some of the weakest options for MFA since hackers can often guess them using brute force password attacks or doing research on the life of the person who owns the account.
- Something the user has. Users may set up protections that include a level of security based on something they have in their possession. This could be something physical, like an ID card or a key fob, or it could be a digital version of this in the form of a smartphone authenticator app. Whatever the user chooses, they must have access to this item in order to log in.
- Something the user is. Inherent factors like biometrics are the user’s physical characteristics or features. Fingerprints, voice or facial recognition, and even retinal patterns are all examples of factors that are unique to the user trying to log in. These are some of the most secure options for MFA because they’re the most difficult to replicate.
Basic elements of multi-factor authentication
How MFA works depends on the factors employed to verify the user’s identity. But the basic process for MFA logins is similar no matter what is used. Once a user has created their account with a name and password, along with the MFA trigger, their login attempt includes:
- Prompt for their MFA factor. After being prompted for their username and password, the user then receives an alert for whichever MFA method they’re using. This could be an option to text a one-time password to their device, instructions to open their smartphone authenticator app or an automated trigger for facial recognition or fingerprint analysis.
- Delivery of the MFA token or factor. Once the prompt has been acknowledged, users receive a text or call with a code or one-time password if this is the form of MFA they’re using. This could also lead to a new prompt arriving if more steps are required for login beyond 2FA.
- Approval or denial. The account or application then accepts the login credentials as legitimate or denies the user access to the application if their identity cannot be confirmed.
Benefits of multi-factor authentication
Taking extra steps and time to log in to applications or accounts can be frustrating for some users, but the benefits of multi-factor authentication significantly outweigh this. The most important benefits are:
- Improved security for third-party applications. Security is naturally the biggest benefit of MFA. With several steps required in order to log in, accounts are better protected from cyberattacks and unauthorized access.
- Greater regulatory compliance. Some industries require additional layers of security due to the nature of the information they retain. MFA adds technical safeguards to data that may fall under HIPAA compliance or other protocols. Without MFA in place, any data breach could leave businesses and their customers vulnerable to cybercriminals.
- The option for passwordless entry. With so many passwords to remember each day, MFA gives users the option to verify their identity in other ways without having to input a password. Not only does this mean users can avoid duplicating passwords to keep them on track, which is insecure in and of itself, but it can also make accounts safer when biometric or other difficult to replicate verification factors are used instead.
Best practices for using multi-factor authentication
Data is only as secure as the barriers in place to keep it protected. When thinking about implementing multi-factor authentication, companies should consider:
- Rolling out MFA company-wide. To minimize the risks of attacks in one department over another, MFA should be integrated across all levels of the company. Before deploying a new system, an analysis should be conducted to find where all access points are through various software or logins. From there, the company should make a plan to add MFA to each of these access points to protect all internal data.
- Offering multiple options for MFA. Giving employees agency over which MFA factors they want to use increases the odds that they’ll opt into using the new system. A one-size-fits-all approach is not always the best solution, so it’s important to balance security and convenience with options available for employee logins.
- Using other security systems alongside MFA. Using MFA alone may not be enough to prevent cyberattacks from occurring. Utilizing additional systems like single sign-on (SSO) through identity and access management software can generate higher levels of security to protect company information.
Keep your company’s most valuable data protected from criminals and unauthorized users with outsourced cybersecurity and privacy services.
Holly Landis
Holly Landis is a freelance writer for G2. She also specializes in being a digital marketing consultant, focusing in on-page SEO, copy, and content writing. She works with SMEs and creative businesses that want to be more intentional with their digital strategies and grow organically on channels they own. As a Brit now living in the USA, you'll usually find her drinking copious amounts of tea in her cherished Anne Boleyn mug while watching endless reruns of Parks and Rec.
