Authentication Factor - definition & overview

An authentication factor is a special category of security credential that is used to verify the identity and authorization of a user attempting to gain access, send communications, or request data from a secured network, system or application.

Each authentication factor represents a category of security controls of the same type. Within each category, security analysts can design or choose a feature that fits their needs in terms of availability, cost, ease of implementation, etc. Increasing the number of authentication factors required to access a system can make the login process more cumbersome and may generate increased user requests for assistance accessing the system. Still, the authentication process helps to ensure that only authorized users can access the network or application.

Here are the five main authentication factor categories and how they work:

Knowledge factors

Knowledge factors require the user to provide data or information before accessing a secured system. A password or personal identification number (PIN) is the most common knowledge-based authentication factor used to restrict access to a system. Most generic applications or network logins require a username/e-mail address and a corresponding password or PIN to gain access. The username or email address is not an authentication factor - this is how the user claims their identity to the system. A password or PIN is used to authenticate that the correct person provides the username or email address.

Possession factors

Possession factors require the user to possess specific information or devices before being granted access to the system. Possession factors are typically controlled through a device known to belong to the correct user. Possession factors enhance security in multifactor authentication by requiring the user to physically possess something besides their knowledge or biometric factors. This could be a hardware token, security key, or a mobile device. By adding this additional layer, even if an attacker gains access to a user's password or biometric data, they still need the physical possession factor to authenticate successfully. This significantly reduces the risk of unauthorized access, making it much harder for malicious actors to compromise all authentication factors simultaneously.

A device like the RSA SecurID can generate one-time passwords, which may be generated automatically and sent to the user's cellular device via SMS. In either case, the correct user must have the device that receives/ generates the one-time password to access the system.

Inherence factors

Inherence factors authenticate access credentials based on factors unique to the user. These include biometric authentication via fingerprints, thumbprints, and palm or handprints. Voice, facial recognition, and retina or iris scans are inherence authentication factors. When properly implemented and secured, biometric authentication can be considered a reliable factor in the authentication process. The drawback is that users may lose flexibility in accessing their accounts. A system that requires a fingerprint scan to access can necessarily only be accessed on devices with hardware that supports that specific authentication factor. This restriction is useful for security but may negatively impact user convenience.

Location factors

Network administrators can implement services that use geolocation security checks to verify a user's location before granting access to an application, network or system.

Imagine a technology company with 100 employees based in San Francisco, California. A security analyst for this organization might recognize that a user attempting to access the network with an IP address originating from outside that state is likely to be a cyber attacker or another unauthorized actor. Geolocation security can be used to ensure that only users within a specific geographic area can gain access to the system.

IP addresses are a useful factor for assessing the origin of network traffic, but hackers can use VPNs to obscure their location. Unique to individual computing devices, MAC addresses can be implemented as a location-based authentication factor to ensure that a system is only accessed from a limited number of authorized devices.

Behavior factors

A behavior-based authentication factor is based on actions undertaken by the user to gain access to the system. Systems that support behavior-based authentication factors may allow users to pre-configure passwords by performing behaviors within a defined interface and repeating them later for identity verification.

Have you seen mobile phone lock screens where the user must draw a specific pattern onto a grid of dots? How about the Windows 8 picture password feature? These are examples of behavior-based authentication factors.

In contrast to MFA factors, individual authentication factors may present security vulnerabilities, sometimes due to user behavior patterns and habits and other times because of technology limitations.

A knowledge-based authentication factor requires users to memorize passwords and PINs. This can lead to users who use overly simplistic passwords and change them too infrequently, making them easy to guess or hack.

A location-based authentication factor can be foiled by technologies that make it difficult to accurately authenticate network traffic's origin.

A behavior-based authentication factor could be observed and replicated by a malicious actor.

Biometric and possession-based authentication factors may be the strongest means of securing a network or application against unauthorized access. Combining these methods into a multifactor authentication process decreases the likelihood of a hacker gaining unauthorized access to the secured network.

Sumo Logic secures its platform using a two-step verification process that incorporates the third-party Google Authenticator (for Android, iOS, and Blackberry), Duo Mobile (for Android and iOS) and Authenticator (for Windows) mobile applications. The combination of knowledge and possession-based authentication factor security significantly decreases the likelihood of credentials being compromised and makes it difficult for attackers to gain unauthorized access to your Sumo Logic account. Sumo Logic's security reputation and commitment to protecting user data are exemplified by our PCI 3.2 DDS compliance.

What should I look for when evaluating an authenticator app?

You'll want an authenticator app that can support multiple authentication factors, including biometric authentication, secure token storage, backup and recovery options, a user-friendly interface, compatibility with various services and customization options. Prioritizing apps that offer strong encryption, regular updates, and a good track record for security can enhance your overall authentication experience.

What is adaptive MFA?

Adaptive MFA is an advanced security method that dynamically adjusts the authentication requirements based on the perceived risk level of a particular login attempt. By analyzing various factors such as user behavior, device information, location and time of access, adaptive MFA can harden security by prompting additional authentication factors only when necessary to verify the user's identity for access. This proactive approach helps enhance security policies while minimizing disruptions for legitimate users.

What role do authentication factors play in a zero trust security model?

Authentication factors are crucial components in the zero trust framework. They limit access based on multiple factors regardless of the user's location or device.