When passwords aren't enough: data protection with MFA

Although modern consumers still prefer passwords to other, more advanced data protection methods, cybersecurity practices show a steadily growing need for extra security measures. This is where multi-factor authentication (MFA) enters the conversation. According to Kęstutis Draugelis, Head of Information Security at Insoft, MFA currently stands as one of the most reliable ways of protecting user accounts.

What is MFA and why is it important?

Multi-factor authentication is a layered process of logging into an account, ultimately requiring more information than just a password. For example, alongside a password, a user may be asked to enter a dynamic code sent via email or scan a fingerprint.

For the end-user, MFA is a reliable method of protecting their personal data held by various institutions and service providers. A password can be guessed or forged, but additional authentication methods, such as a temporary security code, biometrics, geolocation confirmation, etc., add another barrier. This method is designed to protect against modern cyber threats, such as attempts to impersonate a user to log into a bank account, or to leak personal data through an email address.

Minimizing the threat of leaked login credentials

MFA ensures that user accounts remain secure even after a password takeover. By integrating this login method, service providers can counter the risks related to only having a password. "As new cyber threats arise, passwords just aren’t enough anymore. With MFA, users’ accounts remain secure even if the password is leaked, because much wider access is needed for passing the next authentication step," emphasizes K. Draugelis.

While multi-factor authentication is a reliable way to protect important data, from an IT perspective, it is also important to address the potential challenges that arise with its implementation. According to the Head of Information Security at Insoft, these challenges often arise because users themselves resist the additional security steps. To improve this situation, the public needs to be educated about cyber security, and successful and continuous communication is important throughout the process.

Standard vs. customized MFA solutions

Nowadays, the introduction of multi-factor authentication is not only a recommendation, but also a trend. More and more companies want to protect their accounts and important information, which raises a question: is it necessary to look for a tailor-made solution? According to K. Draugelis, off-the-shelf solutions are the standard choice for most service providers, mostly because customized solutions require more resources and financing. "There are many off-the-shelf solutions on the market today for implementing MFA in your own systems," he notes.

Another challenge to implementing multi-factor authentication lies on the side of the end users. Security and ease of use need to be balanced in order to create an intuitive, user-friendly experience. According to the expert, the most user-friendly MFA methods are biometrics and push notifications. However, user preferences are just one variable involved in choosing the right authentication method, so a compromise isn’t always possible.

For companies that wish to adopt MFA but are concerned about the financial cost and complexity of the transition, K. Draugelis recommends carrying out a risk analysis of the stored data. This allows for an objective assessment of the level of security measures that should be applied on a case-by-case basis. It is also very important to educate users about the importance of cyber security and the importance of measures, such as MFA, to ensure data protection.