| Multifactor authentication is defined as using two or more factors to achieve authentication.
Factors include:
(i) Something a user knows (e.g., password/PIN);
(ii) Something a user has (e.g., cryptographic identification device, token); or
(iii) Something a user is (e.g., biometric).
A privileged account is defined as an information system account with authorizations of a privileged user.
Network access is defined as any access to an information system by a user (or process acting on behalf of a user) where said access is obtained through a network connection.
Out Of Band 2 Factor Authentication (OOB2FA) is when one of the authentication factors is provided by a device separate from the system that is used to gain access.
For example, a mobile device, such as a smart phone, is registered within the application to an application user. Upon a successful authentication, the system sends instructions to the registered mobile device in the form of on-screen prompts instructing the user on how to complete the login process.
OOB2FA employs separate communication channels where at least one is independently maintained and trusted to authenticate an end user.
Applications using multifactor authentication when accessing privileged accounts via the network must provide one of the factors by a device separate from the information system gaining access. An example of a separate device would be an RSA token.
Weak authentication can allow easy access for unauthorized users. |
