Jason: In this lesson, we're going to discuss
multifactor authentication, also known as MFA.
Now, when you're using a mobile device,
you're going to authenticate to that device
to be able to unlock it and start using it.
If you think about your smartphone, when you swipe up,
you're initially going to either use your face, your finger,
a PIN, or a password in order to unlock that device
and begin using it.
When you do this, that thing that you're using
to unlock the device is known as an authentication factor.
Now, in the world of cybersecurity,
we have five different authentication factors
that you can use.
These are known as the knowledge factor,
possession factor, inherence factor,
behavior factor, and location factor.
Now, when we look at a knowledge factor,
this is the most simple form of authentication,
and we refer to this as something you know.
If you're thinking about something like your username,
a PIN, a password, these are all knowledge factors
because you're providing an answer to a challenge
such as, "What is your password?"
and being able to authenticate that you are the person
whose username is associated with that password
because you know it.
Now, the biggest problem with knowledge factors
is they are the easiest thing to break
because it's just words or numbers being entered
by a keyboard or by the end user.
So if you're protecting your smartphone
with a four-digit PIN number,
I can actually sit there and try to guess it,
and there's only 10,000 possible combinations
with a four-digit number.
So eventually, I can guess the number,
and I can get into your device.
That's the weakness with a knowledge factor.
The second factor we have is what's known
as a possession factor.
This is something you have.
Now, if you work in a large enterprise environment,
you may have been issued what's called an RSA key fob.
And this is a little device with a small LCD display
that has six numbers on it, that every 30 to 60 seconds,
those numbers are changing.
Now, if you try to log in to a device that is synchronized
with this, you're going to enter those six digits.
And those six digits are changing every 30 to 60 seconds.
So by knowing the right digits,
that proves you have possession of that key fob,
and this is why we call this a possession factor.
Other methods of this are when you use things
like a physical token.
For example, in the US government,
when they try to log in to their computers,
they use their identification card
that has a small microchip embedded in it.
When they place that card into their computer,
that then shows that they have possession of their ID card
and they are who they say they are.
Now, the third factor we have is what's known
as an inherence factor.
Now, an inherence factor is something you are.
I like to think about this as pieces of your body.
So when you think about an inherence factor
or something you are, we're really talking about biometrics.
So if your mobile device uses a fingerprint to unlock it,
that would be an inherence factor.
Similarly, if you're using something like Face ID
where it's going to be looking at the structure of your face
and allowing you to unlock your phone using that,
that is also a biometric factor.
So we would call this an inherence factor,
or something you are.
The fourth factor is what we call a behavior factor,
and I like to refer to this as something you do.
Now, when you're looking at a behavior factor,
this is going to be based on the way you do certain things.
Now, these are not very common in mobile devices,
but they are used in other areas.
For example, in one facility I used to work at,
they had a camera system set up
that would detect you as you were walking into the building.
And the reason they did this is
they were actually measuring the gait of the employees
as they were walking up to the door.
And they were using this as one of the factors
to authenticate the person was who they say they were
because this behavior was unique to each person.
Another area that we see behavior used
is with a voice recognition system.
Now, you may think that the voice recognition
would be an inherence factor, and it could be,
depending on how the authentication system is set up.
But really, most voice recognition systems
aren't looking at what you said,
but they're looking at how you said it.
This is because everyone says things differently.
And there's unique pitches to our voice
and the way we say certain words.
And so this can be a behavior factor as well.
The fifth authentication factor
is what's known as a location factor,
and I like to call this somewhere you are.
Now, your device actually has a GPS receiver inside of it,
so your device at all times knows where it is
on the face of this earth.
So we can actually use that location
as part of your authentication process
and say that you can only log in to that phone
and use it when you're within certain areas.
That might be a country, it might be a state,
or it might be a city or even just a city block
around your building.
This is going to depend on your use case,
but I've been in organizations
where we've had mobile devices that could only operate
and be used within one block of our corporate headquarters.
And if you went further than that,
those devices would actually shut down and lock you out
until you returned back into the perimeter.
And this is known as a location factor.
Now, if we use any of these five factors,
the knowledge factor, possession factor, inherence factor,
behavior factor, or location factor,
we call this single-factor authentication.
So if I take my mobile device, I swipe up,
and I enter a four-digit PIN,
that is a single knowledge factor being presented.
But if I combine two or more of these factors together,
I get what's known as multifactor authentication.
If you're using two factors,
we sometimes call this two-factor authentication, or 2FA.
If you have a mixture of two, three, four, or five
of these factors, this would also be known
as multifactor authentication because you have two or more,
making it multiple factors of authentication.
Now, when you have a device that's issued
from your corporation, they can use their MDM
or mobile device management software to decide exactly
what requirements you're going to have
to be able to access that device.
This could be as simple as setting up a PIN
or a long password that is a certain amount
of characters long, or they might require you
to use an inherence factor or biometric authentication
such as a fingerprint or a facial scan.
This is going to be determined by your corporate policy
and the system and devices that you're using
and what they support.
Most smartphones these days will support
at least one biometric factor or inherence factor.
And that would be either a fingerprint or a facial scan,
depending on the model you're using.
Another use for our smartphones these days is
as part of our two-factor authentication system.
If you go to a website,
there's many times where the website will have you log in
using your username and password,
which is a knowledge factor, or something you know.
And then they'll send you a text message
with a unique code to your smartphone.
What they're doing here is actually creating MFA or 2FA
because they are now using two factors,
the knowledge factor of your username and password,
and the possession factor of the fact
that you have your smartphone and receive that text message.
These days, we're seeing a lot more websites
using two-factor or multifactor authentication
because it does provide a much more secure environment
for your users.
To help with this, there's also an app you can download
called Authenticator, and this serves as a possession factor
inside of your mobile device.
Authenticator allows you to register it with your website
that supports 2FA or MFA.
And it will be used to create those random codes
without having to have a physical key fob device
because your smartphone acts as that key fob
and keeps in sync with the website
you're trying to authenticate to.
So keep this in mind when you think
about multifactor authentication.
Multifactor means you have to have two or more
of these factors.
Now, the last thing I want to mention
when it comes to multifactor authentication,
and this is something that often trips up students,
is that just because you have two factors,
doesn't mean you're at multifactor yet.
If I had you log in with a username, a password,
and a PIN, that is two knowledge factors.
But it is not two-factor authentication
or multifactor authentication because both
of those factors come from the same category.
They are both something you know,
which is a knowledge factor.
To be able to have two-factor authentication
or multifactor authentication, you must have two or more
of the categories represented from the five factors
of knowledge, possession, inherence, behavior, and location.