With the slow but steady move of almost all services to the online world, the ways in which we log on to avail them has too evolved. The terms, username, and passwords have become pretty much a household term. We use online services to buy tickets, pay our bills, E-Commerce and to do financial transactions. These login credentials are what makes us unique in the cyber world. Unsurprisingly, these authenticators for our unique identity are extremely valuable and are always the top priority for an attacker, to gain unfair access to our online lives. Understanding the importance of genuine authentication there are multiple ways in which an individual can be authenticated.
Broadly, authentication takes into account the following factors into account:
What you know
What you have
Who you are.
These factors are implemented either individually or in a combined way to provide a deeper level of security to identity authentication.
What you know
These are perhaps of the of the oldest authentication methods. It's something that you know uniquely. In the olden times it was the passphrase and today we know it universally as the password. Systems identify the unique combination of your login name and your password, and when presented in the right way, grant you access. In order to get past this method of authentication, a user must present the correct username and password combination within a fixed number of tries.
What you have
This method of authentication too has been around since the ancient times. Members of a clan even to these days will get a similar tattoo to be identified with the group. In our context, it’s a tad bit more complicated than a tattoo. Let’s take a simple example of a bank ATM transaction. In order to withdraw money from the ATM, you have to know your PIN (What you know) and also possess your Debit/Credit card which is what you have. You must have observed by now that ATM machines apply the combination of 2 factors, what you have and what you know to authenticate your identity. You can apply the same method to online banking too, in which case the bank either, send you an OTP (One time password) to your mobile device which acts as “what you have”, or you will have to enter a 6 digit number from the RSA key which then is “what you have”.
Who you are
Every time these factors of authentication are combined they provide an even stronger layer of security to the user. Let's face it, PIN can be recovered, mobile devices, RSA tokens, and bank cards can be stolen. In order to mitigate this issue, we introduce the third factor, You. You are unique and one of a kind and the attributes that make you unique, when used as a factor for authentication, present as a formidable layer of security. In order to apply this, we utilize biometrics such as fingerprints (multiple fingers), Iris scans, gait (a manner of walking, stepping, or running) and weight in combination with the factors discussed earlier. Though it is known that it is possible for 2 people to have the same fingerprints, hence in order to make the systems even more impregnable, biometrics are deployed in combination. For example, extremely secure nuclear sites measure the gait of an individual, fingerprints, Iris and the current weight to grant them access to sensitive parts of the facility.
Notable Mention
Apart from these direct factors, one can also utilize a location as one of the factors. For example on some software platforms, a user can only log in from specific IP address. This approach ensures that the system gets traffic from selected locations like the office premise, etc. Here the security protocols of the real world like, access cards, physical registers overlap with the online security measures acting as a formidable barrier for malicious actors.
Things to bear in mind
Any level of security can be breached and the weakest link in any security architecture is almost always the human element. Knowing this if you adopt the following steps you can secure yourself from online breaches:
- Use on-screen keyboards as much as possible to thwart keyloggers
- Do not use simple passwords, use abstract terms/phrases with alphanumeric variations. Common things like name, birthdates, etc must be avoided at all costs
- Do not repeat your passwords across various services, passwords managing apps are recommended
Hopefully, this article helps you to understand how authentication works. Now time for a short sales pitch.
Evomatiq Business Solutions LLC is a trusted, lithe and boutique enterprise software service provider based in Dubai. We help businesses get the most out of their enterprise software like ERPs, CRM, Business Intelligence tools.
11 Sep 2019