What is an authentication factor, why do you need a second one and how many are there in total

Ruslan Rakhmetov, Security Vision

In modern systems, people often interact with each other, with computers and with the outside world through various services: calling a taxi, ordering food, conference calls with colleagues on weekdays and distant friends in their free time. People use them all the time, saving addresses, favourite products, phone numbers, and the security of such data can be compromised if an attacker gains access instead of the ‘right’ user.

Multi-Factor Authentication (MFA) is not a new means of protection against unauthorised access, and it proves its effectiveness year after year. In this article we will talk about different variants of the second factor, the third and the rest, but first we will break down the task of accessing something into its components.

Application of such protection may be relevant for some special cases:

- Services can be paid (calls abroad using roaming, payment for home delivery of groceries, additional space in the cloud for photos from the phone), so access to data can give the attacker and the opportunity to use the victim's finances for their own purposes.

- Data in the service can be simply important for a person (personal correspondence in messenger, commercial secrets of internal work correspondence), so if you lose your password or smartphone without locking, there are risks not only of a financial nature.

In both cases the question of a password in the direct sense (password from a personal account in an electronic shop, password from a corporate e-mail account) or other methods of protection (PIN-code from a bank card, graphic key on the screen of a smartphone) is touched upon. These methods of data protection can be united by a common concept - authentication factor.

Sometimes in addition to the single factor the most important data are protected by the second one, and it can be compared to the following situation: locking the doors of the house and leaving for business, the most valuable things at home can be:

1. Hide them;

2. Put them in a safe;

3. Take it with you.

In this case, we can complicate the work of a hypothetical burglar and add new ‘layers’ of security to the first factor of defence (door lock). Something similar happens in the life of companies: the most valuable data does not leave a certain perimeter (house), is encrypted (hidden) and placed in databases of various services (placed in a safe). In addition to them can be applied privacy tags and special means of protection, which we have already discussed (here and here). For ordinary people and everyday things it is something like GPS trackers on a dog or brightly coloured clothes for a child to quickly find him in a crowd. In fact, there are many different means of protection, but now we will return to the second factor of authentication.

If we think back to the three ways to protect valuables from the residential home example above, there are three ways to prove ownership (authentication factors):

1. Properties of the owner, such as facial shape, eye colour, fingerprints;

2. Knowledge of a password, safe deposit box code, secret word for the bank, or something unique and inaccessible to outsiders;

3. Possession, when the information or valuable object is physically in your possession (files on a flash drive, a favourite piece of jewellery in your purse, etc.).

Additional methods of defence are built on these three types of proof of ownership. In addition to the first factor (account password, house key) for the most important one, you can apply the second factor (2FA) or several factors at once (MFA), combining them and creating new obstacles on the way of an intruder. In this case, the order number in our list is not related to the order of application of means or the depth of protection. Take, for example, the password. It is the most popular and widespread factor of data protection. The presence of a password itself only indirectly affects the safety of data, because it can be‘12345678’, which will take a couple of minutes to find. On the other hand, it is possible to create a complex password, in which case it will most likely be a computer, not a human being, who will do the brute force, and if the intruder has set the goal of gaining access to the data, it is only a matter of time before he achieves it.

Many smartphones and, more recently, computers are protected on the basis of the owner's properties. Such additional factors usually work very quickly, so are in demand where slow processing speeds can negatively impact processes. For example, when paying with a card ‘linked’ to a smartphone at the checkout of a shop in your home, where a text message (we'll further break down such a factor as well) can take longer to arrive than the wrath of a queue. The fingerprint, used in crime investigation, is also used in IT as a way of confirming identity, often as a replacement for the first factor (instead of a password) or to supplement it (a purchase on Google Play or from an NFC terminal).

However, sometimes properties can be spoofed, for example, facial recognition of Asians was hampered by neural network training, so many of them could use ‘face’ to obtain data of a completely different person. In a general sense, this protection factor can be compared to a stamp for entering a nightclub or a pass for entering a university: the idea is quick and simple, but with due diligence and creative skills it is not ideal and can be bypassed.

A third way of organising the protection factor is based on possession of an item or IT tool. So, for example, if you have a personal device in your pocket, you can open a smart lock to enter the entrance to the entrance, and if you receive a text message from the bank (on the same personal phone) - to pay for an online purchase using a card with 3D-secure. As an example, it is also possible to open not only turnstiles to enter the office , but also smart keypads and access to printers and close access to individual rooms.

Such a method will not work effectively if the pass is lost and the mobile phone is stolen by an intruder. To the outside world, the person in possession of your second factor can confirm that they are you.

Based on knowledge, authentication factors are formed, which according to the statistics of 2022 can be ‘hacked’ by a person without additional and complex technical means. In the course of communication, attackers can ‘pull’ from victims knowledge that is used for, for example, online payment. It is not only about CVC-code, which is actually only the first factor of protection in online payments, but also about the code word, pet's name, mother's maiden name and other information that is used somewhere as an additional factor of data protection.

Without realising it, we strengthen our security and use dozens of variations of protective factors. And there are a few habits that are sure to help increase your peace of mind online and in your everyday life. It is impossible to single out one, the best and most effective factor to protect data from unauthorised access, but the freedom to combine and use several of them at once - back each other up, covering the shortcomings.