Hikvision Cybersecurity Director on Multi-Factor Authentication (MFA) to Reduce Security Concerns, Lower Risk of Password Being Hacked
In the last Hikvision blog, we discussed password management strategies and using password managers to reduce security concerns. 
Today, we’ll discuss multi-factor authentication to protect yourself online, and reduce the risk of having your password hacked.
MFA: Multi-Factor Authentication for Protecting Your Online Accounts (Not a Master of Fine Arts)
You don’t need a Master of Fine Arts degree to use MFA (multi-factor authentication). Sorry for the acronym humor. MFA—multi-factor authentication—requires a user to provide an additional means of authentication or verification, in addition to entering a username and password, in order to log into an account or website.
Before we delve into MFA, let’s talk quickly about authentication. Traditionally, authentication is made up of two things, a username and a password.
The username is meant to be the identity of the account. This is not meant to be private or difficult to figure out. In fact, in most cases the username is meant to be public or at least visible to others who use the same system, service, network, etc.
The password is meant to be the secret that is exchanged to allow the user to access the system, service, network, etc. Using just a username and password is known as one-factor authentication because the user is verifying his or her identity with one piece of evidence or one factor
MFA adds two or more pieces of verifiable evidence or factors to the authentication process to greatly reduce security concerns by lowering the chances of an account being accessed by the wrong person. Two-factor authentication (2FA) is a subset of MFA and is a means of authenticating with just two pieces of verifiable evidence or factors. A good real-world example of 2FA is using an ATM. You use something you have, the ATM card, and something you know, your pin number.
There are generally four factors of authentication that are available for us to use today: 
Something you have (i.e. a number generator like Google Authenticator) - Something you know (i.e. a password or passphrase)
- Something you are (i.e. biometrics like fingerprint or facial geometry)
- Where you are (i.e. GPS location tracked by your phone or IP address location)
Below, I’ll explain some options that fit into each of these categories.
Hardware Token: Something you have
A hardware token can come in many forms. Back in the 90s, you could always tell the IT people in a company because they had little fobs on their keychains that had a small display with numbers changing every 30 seconds. This is known as a Time-based One Time Password (TOTP). While this is still an option today, most implementations of TOTP are executed using a mobile app or SMS message (see below). Another popular hardware token is the Yubikey. This is a hardware token that typically is plugged into a computer via USB however some Yubikeys support near field communication which supports devices without USB ports, like an iPhone. To use this token, you log in with your username and password, then, a field appears on the page that asks for the Yubikey authentication. Instead of typing into that field, the user plugs in the Yubikey and touches the sensor. With this physical connection, the key is entered by the Yubikey.
TOTP SMS: Something you have 
The SMS Time-based One Time Password (TOTP) is a text message or email with a numeric code, called a one-time password (OTP) because it is only good for one use. This method is less popular with cybersecurity professionals since it’s been shown to be weak compared to other options but it’s still MUCH better than only using a username and password.
Time-based One Time Password (TOTP) Token: Something you have
Another popular method is the use of a TOTP generator such as those found on the old hardware RSA keychain tokens or a smartphone app like Google Authenticator, LastPass, FreeOTP and others. These numbers change every 30 seconds based on a shared algorithm that the software token and the authentication server both know. There is no network or Internet communication needed to use the soft token. The image below shows the time-based token on a mobile phone and where it is entered into the webpage after the username and password are entered into Google.
Phone/e-mail: Something you have 
Two other TOTP MFA options are to receive a phone call or an email with the MFA code. While this is better than no MFA, it has been shown many times how easy it is for a threat actor to intercept or use this option without the knowledge of the user who owns the account.
Backup Codes: Something you have
Backup codes are provided to you when you set up MFA on many sites. The idea behind the backup codes is that you secure them in a safe locked desk/office, safe deposit box, or an encrypted vault, like your password manager. They are used only if you lose or do not have access to your regularly used MFA. For example, if your phone is stolen, you can no longer use the Google Authenticator. In this case, you could pull out your backup codes and login to your account.
Biometrics: Something you are
Biometrics became mainstream with fingerprint readers and facial recognition technology embedded in the mobile devices and laptops that we use every day. However in those implementations, biometrics is used as an alternative to the username and password rather than as another factor. We don’t see biometrics used much in MFA online these days, but the possibility is there to use it.
GPS: Where you are
GPS location is another factor that isn’t used much for MFA today, but is frequently tracked to find if accounts have been breached. Let’s say that Sally logs in to her company’s VPN from New York City at 8 a.m. on Monday and then logs in to the VPN server again at 10 a.m. from Paris. Obviously, she was not able to get from NYC to Paris in two hours, so the VPN server would deny that second connection and alert the cybersecurity team to investigate.
QR: Something you have
QR Codes are growing in popularity as a method of authentication and in some cases, replacing username and passwords altogether. While this is currently not that common for most Internet users, there is technology in the works today that could make QR codes and cameras in phones and computers the replacement for username and passwords. 
Overview
- We all hate passwords, especially since we need to make them complex, which makes it difficult for us to remember them.
- Password managers allow us to create great passwords for all accounts.
- MFA will further secure an account by requiring more than just a username and password to authenticate.
MFA is offered on many of the most popular websites such as Google, Facebook, Twitter, and LinkedIn, however, most users don’t enable it.
Below are two websites that offer a searchable list of websites that support multi-factor authentication and instructions on how to enable MFA on those sites:
By using MFA as an additional security measure, you can reduce security concerns when logging into your accounts online. For additional cybersecurity insights from Hikvision, visit this link.