Two Factor Authentication - A Secure Method of Access Control

The corporate network infrastructure can withhold a huge amount of data relevant to the company. It is imperative that this data has restricted access, and can not be viewed by unauthorised personnel. There are many ways of implementing an ‘Access Control’ solution which generally utilise a username/ password scenario or possibly having an agent on the end user point that verifies its authenticity. However, for increased protection to highly sensitive networks it is strongly advisable to consider a more secure approach. ‘Two Factor Authentication’ provides a solution to this scenario which is trusted and utilised in the most security conscious of environments including banks and finance sectors.

So why is the old username/ password system considered inappropriate by many top establishments? Firstly the username is generally easy to guess. In normal circumstances it will be based on a very simple formula which revolves around the employees name, which is the same formula used for all employees. So the first step in the process is already relatively insecure. Secondly, the username is combined with a password that goes hand in hand with the username. Passwords are generally easier to guess than people acknowledge and can vary around birthdays, mothers’ maiden names, and are probably very similar to passwords they use for a variety of other accounts. This is generally because so many accounts require passwords; users try to make them as simple as possible so they won’t forget them themselves. To make matters worse, many companies have the policy that passwords expire on a regular basis and force their employees to constantly change them. How does this make matters worse? Well it actually makes the password harder to remember for the operator, who is generally the weakest link in your company’s security. If the operator finds it hard to remember then they are likely to leave a reminder somewhere so they don’t forget themselves. This can be a post it note on the monitor or scraps of paper around the desk either under the keyboard, in the top drawer or in the nearby vicinity.

So what does ‘Two Factor Authentication’ offer? Using this method the user will require an additional piece of information in conjunction with their username/ password to gain access to the network. There are various vendors out there providing different versions of this solution, though the common approach is for a ‘token’ to be issued. The token is a small device which will comfortably fit into your pocket and is quite often able to attach onto your key ring. At any one time the token will display a numerical value. This value will provide an authorisation code unique to the individual employee that when combined with the username/ password will grant access to the network. How is this secure? Well the numerical value on the token changes every 60 seconds. The network infrastructure will be aware of the number that is expected and will verify it against the number being produced. If they match, then the connection will be successful otherwise they are not allowed to connect. This provides huge advances for the security of the network as this token won’t be found next to the computer when the user is away and due to the sheer complexity of the algorithms used to generate the values, the code has never been cracked. Even if someone was given the formula, they couldn’t process the figures quick enough to calculate the next number in anywhere near under a minute. In fact competitions are held regularly where some of the top mathematical minds are allowed months to attempt it, and it is still safe. Also, each number can only be used once, so if a number is compromised after the users fingers are seen typing the digits in, and a hacker tries to repeat that code within the 60 second window, it will already be void.

It also provides a solution for commuting staff that are looking to obtain remote access. They can use this process across a remote access solution, and are able to verify themselves in a very safe and secure manner. No agents will be required to be uploaded to the end user point so staff are not necessarily restricted to what computer they can access the infrastructure on.

This is a brief introduction to ‘Two Factor Authentication’ and provides a very strong and trusted solution for Network Managers.

‘Secure in the Knowledge’

Dean Grimshawe is Head of Marketing at Toranet Ltd - The Network Security Specialists. Toranet work closely with businesses to provide an intricate balance between access and security. By optimising this relationship companies are able to secure their infrastructure while still experiencing efficiency. This scenario produces the greatest return on investment for the client. For further information visit http://www.toranet.net