| Single factor authentication poses unnecessary risk to the information system since most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As users have access to many of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user, to include escalation of privileges.
Factors include:
(i) something you know (e.g., password/PIN);
(ii) something you have (e.g., cryptographic identification device, token); or
(iii) something you are (e.g., biometric).
When one of the authentication factors is provided by a device that is separate from the system that is gaining access, this is referred to as Out of Band Two Factor Authentication (OOB2FA). OOB2FA employs separate communication channels at least one of which is independently maintained and trusted to authenticate an end user.
Non-privileged accounts are not authorized on the firewall regardless of configuration.
|
