The RCTS CERT the Security is a priority and essential for the successful delivery of our institution's services. Two-Factor Authentication (2FA) is the authentication process in which two of three possible authentication factors are combined.
The 3 possible authentication factors are:
- Something the user knows, such as a password, a personal identification number (PIN code) or the answer to a secret question.
- Something the user has, such as a smartphone or a USB device.
- Something the user is, such as face, voice or fingerprint recognition.
Even with best-practice password policies in place, there's always a risk of them being compromised. This is where 2FA technology significantly enhances user authentication security by adding a second authentication factor to credentials based solely on username and password.
As more websites, services, and companies make this technology available, this additional protection is becoming more common. Although initially only a suggestion, it's now becoming almost mandatory, given the persistent cyberthreats that originate from anywhere in the world.
Resistance to adopting 2FA technology in companies is beginning to dissipate, and more and more companies are adopting it, thus minimizing security risks to their infrastructure and services.
This additional layer of security protects users, even if their credentials have been compromised, through a temporary, one-time code or password generated locally, in a smartphone app, or sent via SMS or email. Other methods may include sending a "Push Notification" (a message sent to the smartphone where the user simply approves or denies access) or using a "hard token."
Whatever 2FA solution is designed, it must be simple and easy to use to avoid resistance to its implementation.
This is a very important technology in the cybersecurity landscape, especially at a time when mobile work is contributing to increased cyber risk in companies and among their users.
2FA technology should be used for online banking transactions, online shopping (Amazon, PayPal, Google Play), email (Gmail, Microsoft, Yahoo, Outlook), cloud accounts (Apple, Dropbox), social media (Facebook, Instagram, LinkedIn, Tumblr, Twitter, Snapchat), productivity apps (Evernote, Trello), and communication apps (Skype, Slack). This technology should also be used when accessing corporate VPNs, as this access will naturally enable subsequent access to other resources, and it is crucial that this access does not rely solely on a password.
