Two-Factor Authentication (2FA)
What is Two-Factor Authentication?
Two-factor authentication (2FA), a type of multi-factor authentication (MFA) is an Identity and Access Management security procedure where users are required to authenticate their identity in two separate ways before accessing a secured database, network, or system.
Conventional login processes typically require just a username and password to validate user identity and gain access to secured assets, but 2FA requires an additional method of account verification such as a biometric scan, receiving a secret code via email, SMS, or through an authentication app on a trusted device, or being at a specific geographic location.
Implementing 2FA makes it more challenging for digital adversaries to gain unauthorized access to a secured system. Even if the adversary manages to steal or guess the password, it is unlikely that they will be able to complete the secondary authentication step.
4 Types of Two-Factor Authentication You Should Know
Enterprise security teams can implement two-factor authentication in a variety of ways to block unauthorized access to secure networks and systems. Below are the four main types of 2FA with examples of each.
1. Biometric 2FA
Biometric authentication methods verify the user’s identity based on their unique physical characteristics. Examples of biometric authentication methods include fingerprint and iris/retina scanning, as well as facial and voice recognition.
2. Location-based 2FA
Location-based authentication methods validate a user’s identity by detecting their IP address and associating it with a physical location. Enterprise security teams could implement location-based 2FA to ensure that employees are only accessing sensitive resources from locations that are deemed trusted.
3. Knowledge-based 2FA
Knowledge-based authentication methods require the user to know certain information that must be memorized and never shared with others. Usernames and passwords are the most common type of knowledge-based authentication. Other examples include PIN numbers, image-based verification, and personal security questions.
4. Possession-based 2FA
Possession-based authentication methods validate user identity based on something in their possession, usually a trusted digital asset or electronic device (e.g. email address, phone/phone number, physical security token, etc.) that can receive a one-time or short-term security code.
How Does Two-Factor Authentication Work?
Configuring Two-Factor Authentication
When 2FA is implemented, security teams decide which type(s) of authentication may be used and users configure 2FA as part of the account creation process. Along with selecting a username and password, users will be asked to configure security questions, connect the user account with a trusted device, or provide a biometric scan that can be used to validate their identity in the future.
Initiating a Login Attempt
After account creation is complete and 2FA is configured, users can initiate login attempts by entering their access credentials. A valid username/password combination must be provided before moving on to the second form of authentication.
Request for Authentication
After a user initiates a login attempt and provides valid credentials, they will be requested to complete two-factor authentication according to the method that was chosen by the security teams and implemented during the account creation process.
User Authentication
Next, the user will complete the second authentication step. This could involve providing a biometric scan, providing a secret PIN number, answering security questions, receiving a one-time code on a trusted device, or validating the user’s presence in a specific geographic location.
User Identity Validation and Access Approval/Denial
Once the user’s identity has been validated, their identity is authenticated and they may be permitted to access the secured resource. If authentication fails, access will be denied and security alerts may be generated to indicate a failed login attempt.
Why is Two-Factor Authentication Important?
Reducing the Risk of Unauthorized Access
Two-factor authentication reduces the risk of digital adversaries gaining unauthorized access to secure systems by adding an extra layer of security on top of conventional username/password credentials.
Mitigating Phishing and Social Engineering Attacks
Digital adversaries frequently use social engineering and phishing attacks to manipulate targets into revealing their access credentials.
But while a spoofed domain can easily capture credentials from an unsuspecting target, it's often much harder for adversaries to learn the answers to secret questions (or even what the questions are) or gain access to a user's trusted device via social engineering.
2FA mitigates phishing and social engineering attacks by keeping digital adversaries locked out of secure systems, even after they obtain valid credentials through social engineering.
Avoiding Negative Consequences of a Data Breach
By making it more difficult for digital adversaries to penetrate enterprise networks, 2FA helps enterprises avoid the potential negative consequences of a data breach, including financial losses, regulatory penalties, and reputational damage.
How Do Digital Adversaries Try to Bypass User Authentication?
Brute Force Attacks
Some types of two-factor authentication may be vulnerable to brute force attacks, especially short PIN codes and weak security questions.
Social Engineering
Digital adversaries may be able to bypass 2FA using social engineering techniques.
This could involve stealing the targeted user's personal data and impersonating the user to contact customer service and request to reset or bypass the user's 2FA setup.
OAuth
Open Authorization (OAuth) is a framework that provides applications limited access to a user's data with their permission.
In a ploy known as consent phishing digital adversaries sometimes offer legitimate tools or services to trick unsuspecting users into allowing the adversary to bypass 2FA and gain access to their data.
Cookie Stealing
Websites use cookies to store user session data, allowing users to leave a website and return later without having to login a second time.
Digital adversaries can steal session cookies using a variety of methods and gain access to the user's account without having to login or complete 2FA.
SIM-Jacking
SIM-jacking is when a digital adversary tricks a mobile phone carrier into giving them control of the target's phone number.
After taking control of the phone number, an adversary can try to access any of the user's accounts that use SMS-based 2FA.
Safeguard Your Organization’s Public Attack Surface with ZeroFox
Despite the extra security provided by two-factor authentication, digital adversaries are still finding ways to penetrate enterprise networks using social engineering tactics like phishing and impersonation.
That's why enterprise security teams need to detect and block phishing attempts targeting their executives, employees, and customers.
ZeroFox provides digital risk protection, threat intelligence, and adversary disruption capabilities to detect and counteract phishing scams that attempt to steal credentials or thwart two-factor authentication.
Ready to learn more?
Read our free report 2024 Cybersecurity Trends and Predictions to discover how digital adversaries will leverage social engineering and AI to penetrate target organizations in 2024 - and how to avoid falling victim.