| Multifactor authentication is defined as: using two or more factors to achieve authentication.
Factors include:
(i) something you know (e.g. password/PIN);
(ii) something you have (e.g., cryptographic identification device, token); or
(iii) something you are (e.g., biometric).
A privileged account is defined as: An information system account with authorizations of a privileged user.
When one of the authentication factors is provided by a device that is separate from the system that is gaining access, this is referred to as "out of band two factor authentication". OOB2FA employs separate communication channels at least one of which is independently maintained and trusted to authenticate an end user. One channel could be a mobile device that is registered to the user. Upon a logon attempt, the system sends instructions to the device in the form of on-screen prompts that instruct the user how to complete the login process.
Multifactor authentication provides strong protection for authentication mechanisms. Without a strong authentication method, the system is more easily breached by standard access control attacks. |
