Which Form of MFA is Most Secure Vs. Most Convenient?
The prevalence of data theft is now at an all-time high, and it is this form of attack that is most responsible for data breaches. That’s why implementing Multi-Factor Authentication (MFA) is more important than ever. In this blog post, we’ll go over which form of MFA is most secure vs. most convenient.
Having access to a user’s password credentials is the quickest and easiest way to carry out any sort of risky behaviors. This is because most data and business processes are now primarily cloud-based.
Cybercriminals use the user’s logged in account (especially if it has access to admin privileges) to send phishing email to personal clients and business accounts. The hacker can potentially use ransomware to encrypt your cloud data and demand thousands of dollars to decrypt it.
So, how can you safeguard your online accounts, data and company activities? Mainly with the use of multi-factor authentication (MFA).
Multi-factor authentication provides a considerable barrier to online accounts so even cybercriminals with log in credentials can’t get in. This is mainly because the criminal won’t have direct access to the device that will receive the MFA code necessary to finish the authentication process.
What are the 3 Main Forms of MFA?
When deciding what type of MFA to implement at your company, it is crucial to analyze the three primary approaches and avoid assuming every form is the same. There are some important distinctions that make some much more secure than others and some just more convenient
Let’s examine each of these three approaches in more detail:
SMS:
The form of MFA you are probably most familiar with is an SMS-based one. This is the type most people are accustomed to that utilizes SMS messaging to verify user identity.
When setting up MFA, the user usually enter their mobile number. After that, they will get text messages with time-sensitive codes that they must enter each time they log into their account.
On-Device App Prompts:
Another form of multi-factor authentication will send the code via a specific app. The MFA code still generates during login, but now the user receives it through an app rather than an SMS message.
In most instances, the code is sent along with a push notification. In many cases it can be used on both mobile and desktop apps.
Security Key:
The third form of MFA uses a separate security key that you enter into a PC or mobile device to authenticate your login. The key itself, which is bought at the time you set up your MFA, will be what receives the authentication code and automatically implements it.
This MFA security key is a physical device no bigger than a thumb drive that you must carry on hand to authenticate an a system login.
Now let’s examine the differences amongst these approaches.
Most Convenient Form of MFA:
Most users want to log into their accounts as quick as possible. They typically view MDA as slowing them down. If users have to learn a new software or struggle to remember a security key, this thought process intensifies.
User inconvenience can cause companies not to employ strict multi-factor authentication for their cloud accounts.
If you are seeing pushback to the implantation of MFA, SMS-based authentication may be the best option for you. It is the most convenient form of MFA that requires the least amount of work.
There is no new interface to learn and no software to install because the majority of people are already accustomed to receiving text messages on their phones.
Most Secure Form of MFA:
If your company manages sensitive data via a cloud platform, such as an online banking system, it will be in your best interest to choose security over convenience.
The securest MFA form is the security key.
Your security key is its own separate entity. Say you lose your phone, or it gets stolen, your accounts will still be protected. Both SMS and app-based MFA leave your accounts at risk in this scenario.
You can probably put context clues together to determine SMS-based MFA to be the least secure. This is because malware now exists that can clone a SIM card and give a hacker access to the MFA code sent to that number.
In a Google study that tested the security of each of these forms, the security key proved most secure overall.
Percentage of attacks blocked:
- SMS-based: between 76 – 100%
- On-device app prompt: between 90 – 100%
- Security key: 100% for all three attack types
What’s the Middle-Man?
Where does the app with the device prompt fit into this situation? Between the other two MFA techniques.
It is safer to use an MFA program that sends the code through push notification rather than one that relies solely on SMS. Additionally, it’s more practical than having to always carry a separate security key that may get stolen or lost.
Are You Trying to Set Up MFA at Your Company?
Overall, having any sort of MFA is a step in the right direction. It is a “must-have” solution in the current threat environment, regardless of which form of MFA is most secure vs. most convenient. Let’s talk about your concerns and work together to find a solution to keep your cloud environment more secure.
If you’d like to find out more about what’s new in the tech world, make sure to follow our blog!
Click here to schedule a free 15-minute meeting with Stan Kats, our Founder, and Chief Technologist.
STG IT Consulting Group proudly provides IT Service in Greater Los Angeles and the surrounding areas for all of your IT needs.
