It’s an increasingly common complaint, “If I know my password, why do I need to remember the eye color of my best friend in 5th grade to get into this program?” The requirements may seem a little extreme, especially if your company has never experienced a data breach or major loss, but multi-factor authentication benefits your company by providing an additional layer of protection when access needs to be tightly controlled.
Multi-factor authentication (MFA) is when a user has to provide additional credentials beyond username and password to gain access to a website, program, application, or network. This usually means a password and one of three possible authenticators:
- Information the user knows (PIN number, social security number, favorite 80s movie)
- Something the user has (smart card, mobile phone)
- Something the user is (a fingerprint, retinal scan)
MFA can go further by sending a temporary PIN number or password to your smartphone or a specialized key fob. Every organization is unique and has to satisfy unique needs. These may be due to past security issues or to satisfy a requirement such as PCI compliance. But the authentication process can be a problem for many end-users, especially if they can’t remember the answers they gave when creating their account.
The world is advancing past simple username/password identification. People have so many passwords for business and personal use that they can get mixed up and locked out if they don’t remember the correct one. Following password best practices makes this even more complicated. MFA simplifies all of this.
So the next time you overhear a co-worker complaining aloud that they have to remember personal information such as their dog’s zodiac sign, remember that this is multi-factor authentication at work. Because if you have trouble remembering your uncle’s favorite breakfast cereal, a cybercriminal will find it impossible.