TL;DR
Not all authentication methods are created equal — passwords and SMS codes carry significant vulnerabilities, while biometrics and physical keys offer stronger but still imperfect protection. Organizations should adopt an Adaptive Multi-Factor Authentication (MFA) strategy that evaluates contextual risk signals — such as network location and geography — to dynamically select the most appropriate combination of authentication factors for each login request.
How authentication methods and risk levels work
Applications of all sorts—whether you use them as part of your job or in other day-to-day activities—give users access to a service through authentication. Depending on the sensitivity of the information filtering through the app, different types of authentication methods are required, each corresponding to different risk levels.
In an era of ever-increasing data breaches, username and password credentials are no longer sufficient for authenticating access. Instead, organizations should stack multiple authentication factors together, while understanding that each factor has its own unique strengths and weaknesses.
What are the main types of authentication factors?
Each kind of authentication is called a factor. They're used to verify a user's identity and block access to anyone who isn't who they claim they are. These factors are divided into three groups, ranging from those with the lowest assurance level to those with the greatest assurance level.
- Knowledge factors: Things the user knows, such as passwords or answers to security questions.
- Possession factors: Things the user has, including SMS codes, one-time passwords (OTPs) sent via email, and push notifications.
- Biometric factors: Things the user is, such as fingerprint scanning or facial authentication.
While these factors may feel like they're secure enough on their own, there are security considerations that must be understood before deciding which to use to secure your organization's resources and data.
How secure are different authentication factors?
When implementing a tool for verifying user identity, it's important to understand that some authentication factors are stronger than others—and the ones you think are the most secure may actually be easy to compromise.
Why common factors are more vulnerable than they appear
| Factor type | Examples | Key weakness |
|---|---|---|
| Knowledge factors | Passwords, security questions | Security questions are easy for attackers to guess and difficult for users to remember, as shown in a large study on account recovery at Google. |
| Possession factors | Short Message Service (SMS) codes, OTPs via email, push notifications, physical Universal Serial Bus (USB) keys, mobile authenticator apps | SMS codes can be intercepted; physical keys or devices can be lost or stolen, compromising identity verification once an attacker gains access. |
| Biometric factors | Fingerprint scanning, facial authentication | Fingerprints can be lifted using a piece of tape, and other biometrics can also be replicated in order to trick applications to verify a user's identity. |
Security questions, for instance, are used in applications ranging from email to online government portals. A large study on account recovery at Google showed that answers to security questions are both easy for attackers to guess and difficult for users to remember.
A closer look at possession and biometric factor weaknesses
Sending a Short Message Service (SMS) code is another factor that isn't as secure as it appears. In fact, the National Institute of Standards and Technology no longer endorses SMS codes as an authentication tool because attackers can very easily intercept a message meant for someone else's phone. Physical Universal Serial Bus (USB) keys or mobile devices with an authenticator app can be lost or stolen, and once an attacker has access to a possession factor, the resource's identity verification is compromised.
Though they're considered to be the strongest, even biometric factors like fingerprints and facial verification also have weaknesses. We've all seen the trick to lift fingerprints using a piece of tape, and other biometrics can also be replicated in order to trick applications to verify a user's identity.
What is adaptive multi-factor authentication (MFA) and why does it matter?
Part of deploying a secure authentication method means understanding the risks posed by each factor, and combining them effectively to mitigate those risks. An adaptive approach that evaluates varying circumstances can help align potential authentication factors to the risk level.
- Network: Whether the request originates from a known or unknown network.
- Geography: Whether the request comes from a city or location that is expected for that user.
- Internet Protocol (IP) zone: Whether the IP address falls within a recognized zone for the organization.
How adaptive MFA evaluates login risk in practice
For instance, if your organization's internal database receives an authentication request from a user that is on your network and located within your organization's city and zip code, a password and medium-to-high assurance authentication factor like a physical key or biometric factor is probably all you need to verify that user's identity. However, if the request comes from an unknown network, or from a city that's new for that user, you might consider adding a mobile push request to help prove their identity.
Even though they may sit at different points of the assurance scale, all authentication factors have weaknesses. Organizations looking to better secure their data—and that of their workforce and customers—need to implement an Adaptive MFA approach that assesses the risk of each unique login request, and selects authentication factors accordingly.
Frequently asked questions
Why aren't passwords and security questions enough to protect my organization?
In an era of ever-increasing data breaches, username and password credentials are no longer sufficient for authenticating access. A large study on account recovery at Google showed that answers to security questions are both easy for attackers to guess and difficult for users to remember, making knowledge factors alone an unreliable safeguard for your organization's resources and data.
Why did the National Institute of Standards and Technology (NIST) stop recommending SMS codes as an authentication method?
The National Institute of Standards and Technology (NIST) no longer endorses Short Message Service (SMS) codes as an authentication tool because attackers can very easily intercept a message meant for someone else's phone. This interception risk means that SMS codes, despite their widespread use, do not provide sufficient assurance for securing sensitive resources.
What makes biometric authentication both strong and vulnerable?
Biometric factors like fingerprints and facial verification are considered to be the strongest authentication factors because they are tied to what the user is. However, they also have weaknesses — fingerprints can be lifted using a piece of tape, and other biometrics can also be replicated in order to trick applications to verify a user's identity.
What contextual signals does adaptive MFA use to assess login risk?
An adaptive MFA approach evaluates varying circumstances to align authentication factors to the appropriate risk level. The contextual signals it considers include network, geography, and Internet Protocol (IP) zone, among others, allowing it to dynamically adjust the required authentication factors based on the risk profile of each login request.
When should an organization require additional authentication factors beyond a password?
If an authentication request comes from an unknown network, or from a city that's new for that user, organizations should consider adding additional factors — such as a mobile push request — to help prove the user's identity. Conversely, if the request comes from a user on the organization's network and within its expected geography, a password and a medium-to-high assurance factor like a physical key or biometric factor may be sufficient.
What is the difference between knowledge, possession, and biometric authentication factors?
Knowledge factors are things the user knows, such as passwords or answers to security questions. Possession factors are things the user has, including SMS codes, one-time passwords (OTPs) sent via email, and push notifications. Biometric factors are things the user is, such as fingerprint scanning or facial authentication. These three groups range from the lowest to the greatest assurance level.
