{"id":23929,"date":"2018-08-22T21:01:52","date_gmt":"2018-08-22T17:01:52","guid":{"rendered":"http:\/\/www.msp360.com\/blog\/?p=23929"},"modified":"2021-01-25T17:18:32","modified_gmt":"2021-01-25T13:18:32","slug":"two-factor-authentication-solutions","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/two-factor-authentication-solutions\/","title":{"rendered":"Two-Factor Authentication: Solutions, Methods, Best Practices"},"content":{"rendered":"

With new data breaches being uncovered daily, many companies are desperate to improve security for their clients. The old standard of user login and password is no longer considered very safe. 2FA is a security by-word nowadays. So, why do you still using old log-on techniques?\u00a0\u00a0<\/span><\/p>\n

<\/p>\n

Two-Factor Authentication<\/b> Standards<\/b><\/h2>\n

Major manufacturers of hardware and software have established standards such as the Fast Identity Online (FIDO) system. It lets a user authenticate with touch after entering their name and password. Participants include Microsoft, Intel, PayPal, Google, Samsung, and Lenovo, among others. The system can use authentication hardware built into a phone or laptop, or run over an external device like a USB dongle. <\/span><\/p>\n

How to Implement Two-Factor Authentication<\/b><\/h2>\n

Whatever the hardware or protocol, there are some essential components to a <\/span>two-tier authentication<\/span> system \u2013 the directory service, whether Active Directory, eDirectory, RADIUS or some other system and the add-on <\/span>two-factor authentication software<\/span> that enables the additional functions. There are also <\/span>cloud-based two-factor authentication<\/span> systems available from Google, Microsoft, and others, which are already integrated with their directory services login systems. <\/span><\/p>\n

Two-Factor Authentication Vendors<\/b><\/h2>\n

In addition to the members of the FIDO Alliance, and the directory services vendors mentioned above, who include <\/span>two-factor authentication<\/span> functionality as part of their solutions, there are third-party vendors who offer two-factor solutions, including RSA, Symantec, VASCO Data Security, Quest Software, Okta, CA, and others. In addition to software vendors who add <\/span>two-factor authentication <\/span>to server products, there are a variety of vendors offering hardware tokens, fingerprint readers, FIDO keys, and other devices.<\/span><\/p>\n

<\/a>Choosing the Second Authentication Factor<\/b><\/h2>\n

The first choice to make in setting up a <\/span>two-factor authentication<\/span> system is not to choose the software unless it is chosen for you. For instance, if you use Google for your office suite or Microsoft Office Online, then you will need a two-factor product that will work with your chosen system. For anything else, your first choice should be the type of the second factor you will be using. <\/span><\/p>\n

This is typically a system where security is traded off against cost and complexity. For instance, using a text message code as the second factor is inexpensive and easy to set up. It is also the most likely to be circumvented by a determined hacker. Hardware tokens are much harder to circumvent but are also harder to set up and support, and typically add anywhere from $10-$100 per client in hardware costs. <\/span><\/p>\n

\"Two-factor<\/h3>\n

Common types of 2FA:<\/b><\/h3>\n