Choosing an MFA Solution
Choosing an MFA Solution for Dummies
By now I’m sure you’re all familiar with the terms “MFA (Multi Factor Authentication), 2FA (Two Factor Authentication) or Strong Authentication” over the last few years, for those of you that aren’t these are largely the same thing (there are some technical & semantical differences but for simplicity let’s not get into those) in that they support your traditional Username & Password experience by requiring an additional ‘Factor’ to validate that you are the genuine user. These factors take many forms which I’ve listed below and as we get through this Blog (and at the end) I’ll cover some of the pro’s and con’s:
Find out with Russell how you can implement MFA to your accounts.
- SMS
- Telephony
- OTP
- Hardware Tokens
- Mobile Tokens
- Push-based Tokens
- QR code-based Tokens
OK, so why do I need ‘MFA, 2FA’ or whatever it’s called?
As we’re all probably bored of seeing in the media by now, our credentials are out there on the dark web (or soon will be), with large companies like FaceBook, Nintendo, EquiFAX, etc all being targets and suffering data breaches which have leaked thousands or millions of users passwords and personal details.
These passwords, believe it or not have value on the black market as they allow attackers a foot hold to exploit users & businesses with things like Ransomware, gather more personal information to commit identity theft or just general fraud. What makes this issue even worse is that we as people have a tendency to re-use the same password(s) out of convenience, meaning a single leak on one account could allow attackers a foot hold on others.
MFA helps to stop this by adding that extra Factor which is typically something we need to have physical access to at a given time.
The purpose of this Blog is to help businesses understand what to look for/consider when choosing an MFA solution. There are numerous ‘Buyers Guides’ out there sponsored by respective vendors but they tend to present things in a very enterprise way; which is understandable as enterprises use to be the only businesses which could afford the infrastructure to support MFA. Now days however MFA is something that every business (and every individual for that matter) needs to have to safeguard themselves.
The area’s which need to be considered are:
Ubiquity
Can the MFA solution cover all of my apps and services? Whilst having multiple MFA solutions can be argued as more secure and limits the impact of service failures, it does lead to labour overheads for deployment to existing and new staff as well as create a bit of a laborious experience for staff; having to have multiple Tokens and varying login procedures.
In an ideal world, like Sauron we need to have one solution ‘to rule them all’ as this will give your staff a single simple experience and make implementation & administration long-term more efficient.
In terms of Apps & services the vast majority of businesses will have:
- Devices which they login to – PC’s, Laptops, Hosted Desktops, etc
- Webapps – E-mail and CRM’s are a common example
- VPN/Remote access – plenty of businesses still run systems which reside within the business property and they need a secure way for their staff to access them, VPN’s are perfect for this but they are also a backdoor if not properly secured
Again in an ideal world you’ll want your MFA solution to cover all of these areas
Ease of Use
“Will implementing MFA impact the productivity of my staff?” The best MFA solutions are simple, Push-Based is the industry favourite as it’s very secure and only requires users to approve a prompt on their mobile phone after they’ve entered their username & password. Solutions where you need to answer an incoming call, receive a TXT or read & type a code can be frustrating for some and slow down their login. Depending on the solution you use and where it is deployed you may find that staff members need to re-approve MFA each time they return to their desks. Speaking from my own personal experiences as an MSP, we take security very seriously and although this can be frustrating, we are trusted to hold the keys to many kingdoms so it’s absolutely worth the extra effort but be aware that angry/frustrated users can force businesses into bad (and costly) security practices.
That said, depending on the solution there are options to exclude certain users or locations; if your perimeter network is secure and well managed you can declare your office(s) as safe zones allowing staff to login without MFA whilst they are in the building.
Off-line use is another consideration if you’re seeking to bolster the login security of your staff’s devices, are those staff going to be in areas of poor or no connectivity (commuting to the office, etc)? If so It’s essential that any MFA you chose can work without an internet connection if required.
Flexibility
“What do I do if my staff forget or lose their token?” From time to time we all leave our keys or phone(s) at home or in the office, a good MFA solution should be flexible enough to reduce the frustration(s) of these sorts of mistakes. Some MFA solutions will require your affected staff member to be un-enrolled then re-enrolled; if the device/token is only temporarily unavailable this can be both time consuming for the staff member (and your admin team) to re-enrol once they do get their device back but more importantly can be a big security hole if their account has to be left un-protected for a period of time. A good MFA solution will allow for the issuing of temporary tokens securely via the administrator(s). Similarly should tokens be lost permanently or stolen, you’ll need a solution which can revoke the token and issue a new one/temporary token quickly and easily.
Security
“How secure is the MFA solution?” This may sound like an odd consideration, especially as you’re bringing MFA in to enhance security but, not all MFA solutions are equal in terms of security. Some MFA solutions like SMS or Telephony can be intercepted with social engineering or malware, some OTP solutions have codes which do not expire until they are used or store their data in an insecure way; opening the possibility for an attacker to use a genuine token without the users knowledge.
Look out for solutions who’s tokens cannot be cloned to other devices and can enforce some form of device security such as hiding/disabling the token without a PIN or biometrics.
The audit trail should also be considered, can the MFA solution record where the token request came from, or from what device? These factors can provide an early warning sign that a token has been compromised if requests are coming from an unusual location or from multiple locations/devices too far apart to feasibly be travelled to in the time. This information can also be invaluable when investigating a breach.
Cost
“How much will it cost to deploy and run?” Being a technical person cost is always one of my last considerations, if something is cheap and just about scrapes the brief; save the money and invest elsewhere. When choosing your MFA solution think about your businesses spending attitudes, some businesses prefer capital expenditure over a 1-5 year period others prefer a rolling opex model. In either case think about what it will cost to setup and run the solution:
- will you need to buy hardware or licences?
- when is that hardware/licence expected to be retired?
- What’s it’s capacity (does it accommodate more users than you currently have to allow for growth and can it be expanded – at what cost)?
- Will your internal team set this up or will you need to bring in outside consultancy?
- How much do the tokens cost (if at all)?
- Can your existing team deal with the day to day admin or will you need to add capacity?
If I may offer some specific advice on this; look at cloud solutions, they typically do not require any upfront hardware or software costs for the controller element, all the scaling, backup, maintenance and security testing/patching is handled for you and your deployment labour will be less as a consequence. They’re easier for your internal team to administer and they can have an escalation path if required.
And as for cost? While most cloud services like a recurring monthly income you can often still procure them on a 1-5 year term to give your business that capex feel and keep opex down.
The Good, The Bad & The Ugly
As promised here is a rough break down of each token type, what’s good and bad about it. Keep in mind that like anything in security no one solution is perfect or unbreakable, find the solution which has the best balance of security, ease of use and cost (in that order):
SMS
Good old fashioned SMS or TXT messages; these require you to have a mobile phone number associated with your account so a 6 digit code can be SMS’s to you when logging in.
Pro’s
- No additional physical token to carry around
- No mobile token software to install
- Works on ANY phone (even a Nokia 3210)
Con’s
- Weak security; SMS messages are clear text so any app on your phone which has access to messages (and there an alarming amount) can read these and transmit them to an attacker if compromised
- Typically people like the convenience of seeing messages or part of messages on their lock screen or wearable, leaving the code exposed to should surfing
- In some cases the code doesn’t expire until they have been used
- Open to social engineering attacks; there has been a growing trend of SIM jacking, this is where an attacker contacts your mobile vendor to request a new SIM card and port the victims number so they can receive the SMS code
- Won’t work without a mobile phone signal
- Depending on your carrier this may create complications & cost when abroad
- No centralised control from the business/IT
- May require disclosure of staff’s personal mobile phone numbers (if they are not issued with business devices) which adds to the point above as well as present considerations around personal privacy
- No temporary token option; if users forget their phone they either need to be re-enrolled on another device (which can be time consuming or less secure as it may be a desk phone) or their account is left temporarily un-protected before re-enrolling their old token
- Most security organisations & large enterprises plan to decommission SMS mid to long term due to the weak security and on-going high profile breaches associated to it. As such this methodology may be short lived for a business and require further investment to replace
Telephony
Similar to SMS this methodology makes a call to an associated telephone number and the user authorises by answering the call and pressing #
Pro’s
- No additional physical token to carry around
- No mobile token software to install
- Works on ANY phone (even a Nokia 3210)
- Good for situations where a shared account is used; the DDI of a particular department can be used to answer the call and approve the MFA request
Con’s
- Weak security; this token relies on physical security of the phone(s) or phone system but does mean anyone with physical access to the phones or phone system can intercept the prompt
- Open to social engineering attacks; fake diversion or changes to hunt groups can be made to the person(s) who administer the telephony system
- Won’t work if the phone line or phone system are down
- Can complicate the administration and audit trail as the IT/security team may not be responsible for the telephone system (or may have to learn this additional set of skills) creating admin delays
- Most security organisations & large enterprises plan to decommission this token type mid to long term due to the weak security and on-going high profile breaches associated to it. As such this methodology may be short lived for a business and require further investment to replace
- Sharing of administration accounts and associated MFA is terrible practice from a compliance point of view as its harder to ensure authorised access and audit access requests and investigate incidents
OTP
OTP or One Time Passcode is similar to SMS in that it’s typically a 6 digit code, the main differentiator is that the code is held/generated either via a hardware device (key fob) or a piece of software (most commonly on a mobile phone); the Google Authenticator is a good example of this – check out the Hardware & Mobile sections below when considering OTP
Pro’s
- Simple to use
- Most OTP’s expire within 30-60 seconds giving potential attackers a very small window of opportunity
- Can be used off-line
Con’s
- In some cases tokens do not expire until they are used
- Often these solutions do not have a central management console, users imply enrol with a given token which can lead to overheads if tokens need to retired or reissued
- Can be laborious to type codes in for some users
- Some solutions do not offer a temporary token option if users forget their token, meaning they either need to be re-enrolled (which can be time consuming) or their account is left temporarily un-protected before re-enrolling their old token
- OTP is susceptible to shoulder surfing
Hardware
Hardware tokens come in several forms but in essence can be boiled down to devices which need to be connected to a device such as USB or smart card or a Key fob which displays an OTP code.
Pro’s
- Simple to use
- Physical access to the fob or card is required
- Code algorithm is difficult to crack
- Hardware tokens can be difficult to clone
Con’s
- Hardware tokens can be lost more easily due to their size
- Hardware tokens require a battery replacement/full on replacement periodically
Mobile
Mobile tokens are typically applications which utilise the OTP algorithm
Pro’s
- More convenient as users only need their mobile phone with them
- Software based OTP’s can be backed up making device swapping easier for the user(s)
- Services like Google Authenticator are free and widely used
Con’s
- Some applications offer weak security allowing a compromised device to copy the OTP code and send it to an attacker via the clipboard or screen shot
- Some applications can also be cloned or have their backup mechanism exploited to ‘recover’ the MFA token to another device
- Some OTP applications offer no in-app security so a poorly secured phone can be physically accessed and tokens obtained
Push-Based
This again uses a mobile phone but utilises a push service; what this means is there is an application on the device which has been registered against the MFA solution and the user will receive a pop-up message for them to approve (or deny) when they login.
Pro’s
- Considered the most secure option within the industry
- Quicker & simpler than OTP
- Harder to crack or intercept on the device
- Can act as an early warning if users receive a prompt when not logging in
- Convenient as users only need their mobile phone with them
- Typically offer in-app protection; securing access to the app even if the phone is unlocked
- Can be backed up/migrated to a new device
- Token has a short life span reducing the window of opportunity for an attacker
- Most often compatible with wearables for convenience and added security if users device is unlocked & out of sight
Con’s
- Requires connectivity to the MFA solution/internet
- Some push-based apps can be quicker to exploit than OTP if the users device is unlocked and a prompt comes in
- Some solutions have no temporary token option; if users forget their phone they either need to be re-enrolled on another device (which can be time consuming or not possible) or their account is left temporarily un-protected before re-enrolling their old token
QR Code Based
QR based token require a user to scan a QR code then type the OTP code which is generated.
Pro’s
- Works off-line
- Convenient as users only need their mobile phone with them
- Difficult to intercept or crack
- Token has a short life span reducing the window of opportunity for an attacker
Con’s
- Can be a slow login experience which may frustrate some users. This in turn can hamper productivity, especially if the users need to re-authenticate multiple times due to locking their screen, etc
- Some solutions have no temporary token option; if users forget their phone they either need to be re-enrolled on another device (which can be time consuming or not possible) or their account is left temporarily un-protected before re-enrolling their old token
- Camera issues can affect the performance of QR based solutions
- Use of camera’s within an office/area may be undesirable for other security & compliance reasons
Download an easy to read break down of each token type.
