Authentication is the act of proving to a service, such as a website or an app, who you are with the goal of being granted access. The most common method of authentication is entering a password that—supposedly—only you know. This module deals with how to make authentication more secure and deals with the main threat against authentication: someone with malicious intent being able to successfully authenticate as you.
Three types of authentication
There are three types of authentication:
something you know, such as a password or a PIN;
something you have, such as a phone or a hardware token;
something you are (called ‘biometrics’), such as a fingerprint or a face scan.
Each of these authentication types comes with certain risks. For example, a password may be leaked or guessed, a phone or device may be stolen, and someone may be physically and/or legally forced to press their finger on a fingerprint reader.
Of these, the third option is the most complex and often depends on both local laws and practices. For example, when crossing an international border into the United States, an individual may be forced to unlock a device using their fingerprint but cannot be forced to hand over a passcode to unlock the same device. By contrast, in India, the situation is reversed. In practice, laws aren’t always followed and the security of biometric authentication is something you will have to assess by understanding the context in which you work.
Why multi-factor authentication reduces your risks
Authentication that involves more than one different authentication type from the list above is called multi-factor authentication (MFA). Examples would be a login that requires a password (something you know) and asks you to confirm the login attempt on your phone (something you have). Another example would be paying with a physical credit card (something you have) and entering a PIN (something you know). In practice, there are almost always two factors, so that it is also referred to as two-factor authentication (2FA).
Because of the aforementioned risks with each of the individual factors, MFA seriously reduces the likelihood of account takeovers compared to using a single factor, such as a password. Even the weaker kinds of MFA (more on that later) have been shown to reduce such takeovers by 99% or more.
Many services offer MFA to their users and many company accounts even allow an administrator to make MFA a requirement. Though it is important to understand the implications of MFA, it is recommended to make use of such a setting if available, especially for services such as email or collaboration software that are critical to an organization.
Different MFA methods = different levels of security
The most common kind of MFA combines a password (something you know) with something physical (‘something you have’). Different kinds of second factors exist, with some being stronger than others.
The weakest of these multi-factor methods is SMS. In this case, once a user successfully enters their password, the service sends a text message to a registered mobile phone number. The user then needs to enter the code in that message to log in.
The SMS protocol isn’t very secure and cybercriminals and nation state actors have been known to obtain access to SMS. In some cases, it might also be possible to trick the phone company into moving the number to a different phone controlled by the adversary; this technique is called ‘SIM swapping’. For these reasons, SMS is considered the weakest form of MFA, even if it’s still many times more secure than using a password alone.
SMS-based MFA has another weakness, which is that some phishing websites ask for both the password and the code in the SMS and use these to log into the service in real time. This weakness is not unique to SMS, as the same risk can apply to authentication based on a mobile app, such as Duo Security or Google Authenticator, that shows a six-digit code for each registered service and that changes every 30 seconds. Using an authenticator app is still more secure than SMS-based MFA, though.
An even more secure option is to use an app previously installed on a mobile device that requires the user to confirm their login. A known weakness here can occur when an adversary keeps attempting to log in so that the account owner eventually confirms the login just to stop the notifications.
The strongest kind of MFA is one where the second factor is provided by inserting a physical device, such as a Yubikey, into the computer a user is logging in from (or by connecting such a device via Bluetooth). The authentication protocol used by these devices prevents the kind of ‘meddler-in-the-middle’ attacks described above.
Three ways bad actors can bypass MFA
Although MFA, especially a method based on a physical device, is a very secure kind of authentication, it doesn’t mean that your account can’t be accessed by adversaries.
One way an adversary may achieve this is by obtaining access to a device on which the account is already logged in. This access may be physical, through theft or seizure, or remotely via a remote access trojan, a type of malware.
Some malware also steals session cookies, tokens used by websites to stay logged into a service. These cookies can be used by someone else to hijack a session.
When investigating an account that has been accessed by a rogue actor, always consider this possibility, especially if the account was protected with strong MFA. Note that some services require the password to be entered before performing certain actions on the account; this limits the damage done by session hijacks somewhat.
Another way to bypass MFA occurs on services, such as Google or Microsoft, that allow a user to connect to an app. In some limited cases, adversaries have been known to create a rogue app and then trick their targets into granting their app access to the account.
MFA and messaging apps: add a PIN when possible
A particular mention needs to be made about messaging apps such as Signal, WhatsApp and Telegram that are linked to someone’s phone number. When these accounts are set up, they send an SMS to the user’s phone to confirm their phone number.
The aforementioned weakness in SMS means that someone with access to that initial SMS can register the account on another device. Although the use of end-to-end encryption on Signal and WhatsApp (but not Telegram) prevents the message history from being shared and a warning about a new phone is shown on correspondents’ devices, this is still an effective way to impersonate someone.
The best way to prevent this is MFA: in this case, the second factor would be something you know. Signal, WhatsApp and Telegram all allow users to protect an account with a PIN code or password.
Considering lockouts when enabling MFA
MFA makes it a lot harder for an adversary to log into a service. Unfortunately, it also makes it harder for the account holder to do the same. Now, users have to avoid forgetting their passwords and losing their phone or MFA token.
It’s wise to consider this drawback when setting up MFA or before mandating the use of MFA within your organization. Consider questions like:
What will you do when someone locks themselves out of an account?
How do you confirm their identity in such a scenario, especially if it happens when they are traveling?
Finding a good balance here isn’t trivial!
Password security: combine a strong password with MFA
If someone enters a password into a phishing site or if a password gets stolen during a data breach, this information will be in the hands of an adversary, no matter how strong the password itself. If the password is also used on other accounts, those may also be compromised. (It’s important to note that though passwords can be leaked in data breaches, the way passwords are stored, or “hashed,” has improved in recent years and many breaches no longer include recoverable passwords.)
The most important step to ensure a password is strong is to combine it with MFA, as described above, and to ensure it is not used elsewhere.
For sure, a stronger password—the longer, the more different kinds of characters it contains and the less guessable it is, the better—matters too, but password strength alone shouldn’t be mistaken for total security.
Use password managers + strong passwords
To quote a cybersecurity veteran: “the advice about passwords is to choose one so strong you can’t remember it, then don’t write it down.”
To solve this conundrum, passwords managers are a great help. They store passwords in a secure way and almost always can generate new passwords for you, too. The way password managers work is that you choose a primary password that is used to encrypt a vault that contains all your other passwords. Depending on the kind of security you need, the vault can be stored on a device itself or in the cloud. In the latter case, a password manager can be used on multiple devices.
When using a password manager, there is no excuse not to use strong and unique passwords. This process is simplified on a password manager, which can generate passwords and then enter them for you, or can make it easy for you to copy and paste them into the service you’re using. A password manager that is integrated into a browser also has the added benefit of preventing you from entering the password into a phishing page, as the domain won’t match that of the service for which the password was generated.
Why password managers aren't a replacement for MFA
Password managers should never be seen as a replacement for MFA, however. In fact, they work especially well in combination with MFA. Neither is perfect, but together they offer a very strong kind of security.
Most password managers also offer MFA to protect your account. We strongly recommend that you set this up to prevent the master password—which should be really strong and unique—from becoming a single point of failure. After all, this password can be used to access any password stored in the vault.
Do note though that MFA doesn’t protect against a breach of the password manager in which the vault itself gets stolen. In this case, the password is the only protection. (This happened at LastPass in 2022, a case made worse by LastPass’s poor communication on the issue. If this happens to you, you should change all important passwords and the manager’s primary password.)
Password managers can be set up individually or throughout an organization. The latter will make it easier for your staff to use them.
Changing passwords: once a year is probably enough for most
In the past it was considered good security practice to require staff members to change their passwords regularly, for example every three months. More recently, this practice has been considered unnecessary and perhaps even counterproductive: it encourages users to choose a password that ends in a number that they increase by 1 every time that they are required to change the password.
In an ideal system, there should be no need for users to ever change passwords, except for when there is evidence of a password having been accessed by an adversary. In practice, systems and organizations are rarely perfect and passwords are shared with people who then leave the organization or are stolen without anyone noticing. Sometimes organizations are breached through very old passwords that still work.
Therefore, setting a policy—enforced on systems that support it—where passwords are required to be changed occasionally will improve security. Once a year is probably good enough for most organizations. If staff use a password manager, choosing a new secure password should be trivial.
More mature organizations may be able to go passwordless
For many years, security experts have predicted the end of passwords. After all, passwords depend on humans, who may choose weak ones or fall for a phishing attempt. And while passwords will likely be around for the foreseeable future, there are authentication solutions that do not depend on passwords.
These are referred to as ‘passwordless’ solutions, which has become a buzzword in recent years. Despite the hype, such systems do exist and are something worth considering. An example would be a device, such as a phone or a laptop, that is registered with a service and then used to access that service, typically after the user authenticates locally. This authentication may happen through biometrics, for example, using a fingerprint. (Sometimes, however, the local authentication happens through a password or PIN, which makes these systems not as ‘passwordless’ as the name suggests.)
Note that this kind of authentication is actually an example of MFA: the device is something you have while the biometrics is something you are.
It requires a certain organizational maturity to use passwordless solutions for authentication. Using a system like this requires a smooth procedure to enroll new devices and, ideally, devices would be provided by the organization. For those organizations for whom it works, it might save some headaches surrounding authentication, but it won’t completely stop account takeovers, nor does it mean that passwords won’t ever be used inside an organization.
Authentication may be easier with single sign-on
Closely linked to passwordless solutions is single sign-on. This is a workflow in which a service, typically run by a third-party company, is used for authentication. Staff members log into this service, which then handles authentication on other services that support it. This single sign-on service may be passwordless or not.
For an organization that has reached some organizational maturity, single sign-on may make authentication a more smooth process for its staff members. But, like passwordless solutions, it won’t totally stop account takeovers.
Photo by regularguy.eth from Unsplash