And the battle has only just begun as, in recent months, security professionals have amplified the cry following attacks from DigiNotar, Anonymous and WikiLeaks – and the list goes on. Organizations need to get a grip on their borders, now, or risk losing the cyber fight and becoming another statistic.
The threats an organization faces are multifaceted. While it’s possible, and perhaps tempting, to spend millions plugging every hole the reality is it’s impractical. Instead a more common sense approach to security is required.
At the heart of the problem is that, with every breach incident, the likelihood of a user’s identity having been compromised increases. Therefore, it doesn’t matter how intrinsic the overarching security approach, it is fundamentally flawed if you fail to establish that the person gaining access is who they claim to be. For example, while a VPN provides a secure communication tunnel, if a hacker can mimic a legitimate user and use their key to open the pipe then everything traveling down it is insecure.
Physical security is common sense in a virtual world too
In the real world we regularly use Chip and Pin to make a purchase in the high street, or withdraw cash from an ATM. Quite simply this is two factor authentication in action in the real world.
Before clarifying what constitutes two factor authentication, it is probably worth stating what it is not. A password on a PC (often referred to as single factor authentication) is the equivalent of a basic lock – only slightly better than nothing. It stands to reason that two passwords - even if one is a data pattern or random characters from a memorable phrase, it is actually just two locks. Although it may slow an intruder by having another password, common sense should tell you it still isn’t adequate.
Two factor authentication, in its very basic sense, is the combination of two different elements from a choice of three:
- Something you know – such as a pin or password
- Something you own – such as a key, token or the chip embedded in a credit card
- Something specific to the person – such as a fingerprint, or retina.
This leaves the combination of something you know and something you own as the only practical two factor authentication solution.
The keys to the vault
Something you own invariably means a security token. There are two types – hardware-based i.e. a physical token and software based, such as an SMS-based token received on a mobile phone - often described as a tokenless two-factor-authentication system.