Two-Factor Authentication: Multiple Locks for the Same Door

You want to make network security one of your top priorities, especially these days when you can hardly go online without feeling like someone’s trying to take advantage of you. The password still plays a dominant role in network security, but the fact remains that it’s only one credential that hackers need to target you. Instead of depending on the password, more businesses are shifting to two-factor authentication, or 2FA.

Today, we’re examining how 2FA or multi-factor authentication (MFA) can keep your business and personal accounts safe and secure.

Understanding 2FA

Basically, the gist of 2FA is that you need to verify your identity upon login by two credentials: a password (preferably a complex, unique one) and some secondary measure that usually falls into one of these categories:

• Something you know - Your password.
• Something you have - A physical token, your phone (for codes), or a hardware key.
• Something you are - A biometric like a fingerprint or facial scan.

For example, you might enter your password as usual, but then you’ll go to your phone to check for a secondary code or a security key. The goal here is to make it as difficult as possible for someone to break into an account with just the password.

2FA Offers a Serious Boost to Security

Most users will enjoy a significant increase in security compared to if they were only using a password. It reduces the risk of unauthorized access and puts an end to brute-force attacks. It also protects you from the increasingly crafty phishing attacks that target businesses like yours each and every day. Data from Google and Microsoft strongly suggest that having 2FA has led to a dramatic reduction in successful account takeovers, so it’s time to start taking it seriously.

It’s Not a Failsafe

2FA might improve security, but certain complex attacks can still be carried out successfully. Here are some of the ways scammers and hackers are getting around 2FA and what you can do about it.

Man-in-the-Middle Phishing

2FA can stop would-be phishing attacks, but more advanced MitM attacks can trick users into giving up both their password and their 2FA code using a fake website. The attacker then relays those credentials to the real site to gain access.

SIM Swapping

In this type of hack, the attacker might convince a mobile carrier into transferring your phone number to a SIM they control. This gives them the power to receive your 2FA codes. While it seems like a lot of effort, the attacker basically has unlimited freedom to unlock any of your 2FA-connected accounts.

Malware

Certain malware variants can steal your 2FA codes, or even control your device, all to get around the 2FA prompts. 

Social Engineering

A hacker might even try to use social engineering tactics, like convincing customer support to reset your 2FA or to grant them access to important information. Make sure you’re being careful with how (and where) you’re sharing information about yourself.

Physical Theft

Perhaps the most obvious way hackers can get around 2FA is if they have your phone or hardware security key. They can easily bypass all of your 2FA if your device is unlocked or your key is unprotected.

Some 2FA Options Are Better Than Others

Depending on the method, you might see varying results from 2FA providers:

• SMS-based 2FA - While convenient, SMS is generally considered the least secure form of 2FA due to vulnerabilities like SIM swapping.
• Authenticator Apps (TOTP) - Apps generate time-based one-time passwords (TOTP). These are generally more secure than SMS as they don't rely on your phone number.
• Hardware Security Keys (FIDO/U2F) - These devices are considered the gold standard for 2FA. They offer strong protection against phishing and malware because they cryptographically verify the website's authenticity before providing a second factor.
• Biometrics - Fingerprint or facial recognition can be convenient and relatively secure, but they are tied to the security of the device itself.

2FA Is Still Essential for Network Security

2FA is way more secure than your standard password, so you’ll want to use it on most, if not all, of your accounts if you can. We recommend you enable it wherever possible, but if you can’t, make sure you’re still remaining cautious about phishing attacks. Furthermore, be sure to double-check URLs, be wary of suspicious requests, and keep your devices secured. For any and all of your 2FA and network security needs, reach out to Horne & Benik at (603) 499-4400.