¿Cuál es la mejor manera de implementar la autenticación multifactor? (2024)

Identity acts as the primary defense mechanism for our data. MFA can make it harder for hackers to access sensitive data or systems by stealing or guessing passwords. MFA can also help detect and alert users of any suspicious login attempts or account changes. While there are many methods of MFA, organizations should focus on implementing more secure method of secondary authentication option such as an Authenticator App, FIDO2 etc. Also, an additional benefit of using such authenticator app would be that from your device, you can have a third layer of protection to the application such as facial recognition etc. to open the authenticator app.

Traducido

In my experience the rush to MFA has been a bit clunky and too vendor-centric. So many shops are buying the 'tool' without understanding all the concepts. Just having another Factor in your MFA stacked authentication is rather crude when compared to ensuring existing factors and can cause more friction than benefit if ancillary factors are not in place. Valid managed certificate on the device (what you have), password hygiene (what you know) are the basics and should always be first and most robust. Biometrics are just not ready and SAML without the pre-work can be a disaster if not done carefully

Traducido

For most users, biometrics are very easy to use, fingerprints and facial recognition are user friendly, but may not be the most secure. Hardware tokens are very secure, and straightforward to use even if they add cost to the implementation. Passive factors like GPS location or using a "recognized" device adds an extra factor of security without user interaction. Incorporating any form of MFA is a giant leap in security over using passwords alone.

Traducido

(editado)

The right factors should be user friendly and not feel intrusive. A good idea would be to use a combination of common methods such as credentials, a code push to phone or a thumb print. Most importantly, for biometrics it falls under PII and has procedures that you must follow in collecting it. Therefore, you have to ensure that any storage of this data is in regulatory compliance. This means making sure it is secure and anonymized (i.e. mapping it to id numbers or masked names.)

Traducido

1. Enable MFA for Each account:Enable MFA on all your accounts that support it, especially for sensitive accounts like email, banking, and social media. 2. Use Several Authentication Methods:implement use of different authentication methods for each account. Common methods include text messages, authenticator apps (like Google Authenticator or Authy), hardware tokens, and biometric methods (fingerprint or facial recognition). .3. Select Authenticator Apps over SMS:Authenticator apps are generally more secure than SMS-based MFA. SMS can be intercepted, whereas authenticator apps generate time-based or event-based codes offline. Recommended to pick authenticator apps or hardware tokens over SMS.

Traducido

MFA needs to be co figured for every application. This also has to be mandated from the top down. There can be no exceptions.

Traducido

The risk based approach is always necessary not only to effectively use IT budget investment and optimise running costs, or better more in general to minimise TCO, but also to minimise the user experience impacts. Behaviour analysis of the users, localisation of accesses, device and transactions risk and connection with faud and incidents on similar transactions should be factors to be considered.

Traducido

(editado)

The key is to make security awareness apart of the organizations culture. The goal should be to continuously remind employees and consumers. Then, users will know that a little inconvenience is better than having a compromised account.

Traducido

In the Uber breach, the method employed by the hacker was known as an "MFA fatigue" attack, where the genuine user gave up the MFA code to the attacker after receiving a flood of MFA notifications. As always, humans are the weakest link in the chain. Without user awareness, no amount of sophisticated technology can save you from attacks.

Traducido

After choosing the factors you are going to use for your MFA strategy, it is important to review feedback on your efforts and make updates. For example, challenges may force you to implement a change in your factors or implement a different verification software. Overall, you want to continuously check that your multi-factor authentication program is working as it should.

Traducido

Indeed MFA is just one of many countermeasures to be considered in a real zero trust approach more and more focused on identity in a perimeiterless environment

Traducido

Enforcing MFA and educating users are the most important things to focus on. MFA and Passkeys are principles to prove identity many times and confirm even if credetnials stolen, the bad guys can't take advantage of them without having the other authentication factors like PIN, biometrics, OTP or tokens.#MFA #Passkeys #User_training #Awareness #enforcement

Traducido

Something that is missing here is the fact that many applications have multiple ways to authenticate users. A common misconception is that if we enable MFA, it becomes untenable to brute force it, which certainly has some truth to it. However, other very related aspects need to be addressed. If I can lift a cookie containing everything an application needs to authorize an action, it bypasses MFA entirely. This is something we have seen recently in some very high-profile breaches.TL;DR:1. Good MFA policies and factors are used (SMS is not valid)2. Understanding where MFA is bypassed3. Use additional context within applications to decide if we need to force the user to re-authenticate to perform sensitive actions4. Zero Trust strategies

Traducido

To implement multi-factor authentication (MFA) effectively, start by assessing your organization's security needs. Choose user-friendly MFA methods like passwords and smartphones, ensuring secure data transmission. Enforce MFA for sensitive access, educate users, and maintain a continuous review process to adapt to evolving threats and user needs.

Traducido