866.656.3338 sales@diversecomputing.com

AA101: A Crash Course Explaining Advanced Authentication

Date Posted - 6th Aug 2013 |  Category - CJIS Security Policy, Common IT Headaches, Newsletter

eAgent_X2_Web_Image_Ver1_Cropped_550pix (1) copy

In this week’s blog, we will give an easy-to-understand explanation of Advanced Authentication (“AA” for short). Let’s start by defining what the word “authentication” means.

Whenever someone requests access to a system or to sensitive information, that someone needs to prove that they are indeed the correct person and not an impersonator.

Typically, authenticating your identity is verified by a user name and password. If you live in today’s connected world, you probably have a plethora of log-ins and passwords for applications like e-mail, social media sites, e-commerce stores, etc.

This password system works well for the most part… until a hacker figures out your password.

We are guessing that every one of you has received a message from one of your friends or family members stating something like “Hey, my e-mail account was hacked… please disregard that e-mail message about how you can earn you some quick cash.”

Unfortunately, hackers are getting better and better at either running programs to figure out your password or at extracting passwords from breached websites.

Remember back in June, 2012 how LinkedIn had their systems compromised? Over 6.5 million user passwords were leaked.

And stories about hacked sites and compromised user info are becoming more and more common.

To help combat this trend, many companies and industries are utilizing “multi-factor” or “advanced” authentication.

That is, instead of a user simply authenticating their identity with a password (i.e. something the user “knows”), the user is forced to have another authentication method based on something the user “has” (e.g. a card, smartphone, token) or something the user “is” (e.g. a biometric characteristic of the user like a fingerprint).

For a method to be truly “multi-factor,” it is crucial for the user to present authentication factors from at least 2 different categories.

A good example of AA is when you take out money from an ATM.

The first authentication factor is your having possession of your bank card as you slide it into the machine (“something the user has”).

You then get asked for your PIN (“something the user knows”).

Unless you have both your card AND know the PIN, authentication does not succeed, and the ATM locks you out (No money for you).

This ATM scenario illustrates the basic concept of most two-factor authentication systems available on the market– the combination of a knowledge factor and a possession factor.

By having an AA system in place, you are able to prevent most impersonators and hackers from gaining access to your systems than if you just required a password.

There are many options for establishing an AA system. Next week, we will discuss the different second factor methods on the market and the pros and cons of each.

Until then, stay safe, stay tuned and stay advanced.


 

We have created an Advanced Authentication solution that law enforcement agencies the flexibility to utilize 4 different authentication methods for their officers. Click here to learn more, or call us at 850-656-3338.

See_how_it_works_HP_CTAB_75pix_Tall copy

 

If you find the content in this blog useful and would like to receive this information on a weekly basis, please subscribe to our newsletter here.