What are the Different Types of Factor Authentication?

As industry leaders Transmit Security explains (https://www.transmitsecurity.com/blog/passwordless-authentication-guide), there are many types of authentication factors, which are used to validate the identity of an entity. I doubt there is anyone in the world today with access to a mobile phone or laptop which doesn’t know what factor authentication is.

Try and remember all those times you were having a hard time logging into your email? When you had to provide a backup email so that a one-time password (OTP) would be sent to you.

Or you had to receive an SMS text containing a PIN that would allow you access to a site or an app. That is factor Authentication in play.

What is Multi-factor Authentication?

Multi-factor authentication (MFA), sometimes used interchangeably with two-factor authentication (2FA) is a method of authentication where the user is supposed to provide two or more factors of Identity to gain access to a certain resource.

It is the most secure system to date on the internets, as it employs the use of one or more layers of security compared to traditional authentication which just asks for a username and password.

While still important in today’s world, passwords, which are essentially the first layer or factor of authentication, are extremely vulnerable to cyber-attacks.

Adding another layer of protection, like OTPs and Biometric data means the attacker has to do much more to access information from the digital library.

A quick side note before we move on is that the only difference between MFA and 2FA is that MFA requires two or more factors while 2FA uses 2 factors of authentication.

What are these factors of Authentication?

A question that most of us ask is, what exactly is a factor? Simple, a factor of authentication is a category of authentication.

We currently have three main authentication factors with a couple of lesser-used categories.

These are:

Knowledge Factors or What the user knows

This category of authentication needs the user to provide some information before being able to gain access to a resource.

Passwords and Personal Identification numbers (PIN) are the most common types of Knowledge and the earliest ones in use.

For those that are new to the internets, a typical login would involve you providing either a username or your email, followed by a password.

An important point to note is that the username in this case just claims that your identity exists in the system, the password or PIN verifies that the identity belongs to you.

Possession-based Factors or What the User has

This category focuses mainly on the possessions that a user has. The global uptake and rise in the use of smartphones have enabled this factor to be used a lot more often in recent years.

In possession-based authentication the process usually resembles something like this:

• A user registers an account and is prompted to give their email address and phone number
• On completing the registration, the user logs in to their new account with their username and password
• Before the user gains access to the system, an OTP is sent to the user’s phone either via email or SMS and they are required to input it to have full control of their account.

Another version of this involves the user having a physical token like access badges or smartcards that a user inputs into a device before being prompted to provide a password.

Inherence Factors or What the users are

These factors usually involve the use of parts of the human body that are unique to individuals and thus provide unique identification for verification.

The most common ones include fingerprints, facial recognition, voice recognition, and retina or iris scans.

Other less commonly known authentication factors include:

1. Location-based – which compares a user’s location with the location requirements of a specific system. If a user is not around the location limits then they are denied access.
2. Adaptive Authentication – A much more recent development, adaptive authentication also known as Risk-based authentication analyses additional factors by looking at the context of the log-in.

These additional factors are:

• Where the login is happening from?
• When is it happening?
• What device is being used?

Once these questions are answered, the level of risk is assessed and the appropriate level of security is administered.

Benefits of Multi-factor Identification

Reduced Operating costs as companies save funds that were previously allocated to Data Breaches
Improved customer satisfaction, trust, and loyalty.

Companies can increase their conversion rates as streamlined and secure authentication leads to high productivity.