Are you who you say you are?
It sounds dramatic, but you’re asked this question hundreds of times a month by your company network, your phone, your bank, your email account and more. Authentication is the “assurance and confirmation of a user’s identity.”
3 Factors of Authentication
It’s always more secure to use two or multiple factors of authentication, known as multi-factor authentication or MFA, instead of one. For example, an ATM uses two-factor authentication, since it requires your debit card (something you have) and your PIN (something you know).
The three factors of authentication are defined as something the user:
- Knows – A password, PIN or an answer to a secret question.
- Has – An access card or USB key.
- Is – Facial features, eye structure or fingerprints.
In its guide to authentication, Okta adds an additional type called behavioral biometrics which is something the user does. To discuss the types of authentication, I’ve combined what a user is and what a user does into one biometrics category.
Type 1: Something the User Knows
Password
Password authentication uses the Password Authentication Protocol (PAP), which sends the username and password to the server to check its validity.
According to a study from NordPass, the average person has 100 passwords to remember. The sheer number of online accounts (for work and personal life) can tempt users to create guessable passwords, compromising security. It’s important for organizations to encourage users to create complex, long and unique passwords.
One-Time Password (OTP)
In one-time password (OTP) authentication, the user receives a unique password from a text message, application or email.
The time-based one-time password (TOTP) adds a time limit to the password, making it more secure.
CAPTCHA and reCAPTCHA
CAPTCHA stands for the Completely Automated Public Turing test to tell Computers and Humans Apart. Created in 2000, its purpose is to distinguish human website visitors from bots by giving a task that people can pass easily but bots cannot.
reCAPTCHA has a “risk analysis engine” that can predict whether a user is human or not. If it can’t decide, it prompts a CAPTCHA.
Single Sign-On (SSO)
With single sign-on (SSO), users use one password to authenticate with and access multiple applications and websites. To use SSO, organizations choose an identity provider, which exchanges a certificate with the application or website to authenticate.
SSO has strong advantages and disadvantages. By only using one password, employees can focus more on their work and avoid constantly resetting passwords. However, if employees use weak passwords, a hacker can access multiple systems quickly.
Type 2: Something the User Has
Certificate
To access resources from servers, a client receives a physical or electronic certificate from the network’s security server. Any other server in the network can validate the certificate and establish the connection.
Security Token
Security tokens are like certificates, but they include information about what the user can access. A token can be a physical device (such as a USB key or other device to plug into a laptop) or a piece of data that has no meaning or use on its own, but combined with the correct tokenization system, becomes a vital entity in securing an application.
Public Key and Private Key
Public key authentication includes two types of keys: one public and one private. Anyone can see the public key, but the private key is secret. The private key generates a signature that can’t be created by anyone who doesn’t have it. The public key is used to verify the signature’s authenticity.
Public key authentication is preferred over password authentication because signatures can’t be reused. Hackers who find used signatures can’t access the server.
Type 3: Something the User Is or Does
Physical Biometrics
Physical biometrics include facial features, eye structure, fingers (especially fingerprints), hand shape and more. Because physical biometrics are inseparable from the user, they provide more certainty and less risk than other types of authentication.
Behavioral Biometrics
Behavioral biometrics track a user’s unique actions – their typing speed or force of pressing keys, for example – to verify identity. To implement behavioral biometrics, devices record how a user typically behaves and compare it to the user’s actions throughout the session.
The Future of Authentication
Some experts are interested in replacing passwords with biometrics for authentication. Microsoft and Apple are taking steps toward a passwordless future, but it may take years before passwords are fully replaced.
Regardless of which type of authentication is preferred in the future, its importance will only grow as data security becomes a bigger concern. As a managed file transfer (MFT) company, the security of our customers’ data is crucial.
Thru currently supports the following types of authentication:
- Multi-factor
- Single sign-on (SSO)
- Password
- Key
- Certificates
Learn more about our secure file transfer and compliance stance »
