SoftLayer Blog » token http://blog.softlayer.com A Behind the Scenes Look at the Best Hosting Provider in the World Fri, 24 May 2013 18:19:59 +0000 en-US hourly 1 http://wordpress.org/?v=3.4.1 The Pros and Cons of Two-Factor Authentication http://blog.softlayer.com/2011/the-pros-and-cons-of-two-factor-authentication/ http://blog.softlayer.com/2011/the-pros-and-cons-of-two-factor-authentication/#comments Fri, 30 Dec 2011 16:15:47 +0000 Steve Kinman http://blog.softlayer.com/?p=6779 The government (FISMA), banks (PCI) and the healthcare industry are huge proponents of two-factor authentication, a security measure that requires two different kinds of evidence that you are who you say you are … or that you should have access to what you’re trying to access. In many cases, it involves using a combination of a physical device and a secure password, so those huge industries were early adopters of the practice. In our definition, two-factor authentication is providing “something you know, and something you have.” When you’re talking about national security, money or people’s lives, you don’t want someone with “password” as their password to unwittingly share his or her access to reams valuable information.

What is there not to like about two-factor identification?

That question is one of the biggest issues I’ve run into as we continue pursuing compliance and best practices in security … We can turn on two-factor authentication everywhere – the portal, the vpn, the PoPs, internal servers, desktops, wireless devices – and make the entire SoftLayer IS team hate us, or we can tell all the admins, auditors and security chiefs of the world to harden their infrastructure without it.

Regardless of which direction we go, someone isn’t going to like me when this decision is made.

There are definite pros and cons of implementing and requiring two-factor authentication everywhere, so I started a running list that I’ve copied below. At the end of this post, I’d love for you to weigh in with your thoughts on this subject. Any ideas and perspective you can provide as a customer will help us make informed decisions as we move forward.

Pros

  • It’s secure. Really secure.
  • It is a great deterrent. Why even try to hack an account when you know a secondary token is going to be needed (and only good for a few seconds)?
  • It can keep you or your company from being in the news for all the wrong reasons!

Cons

  • It’s slow and cumbersome … Let’s do some math, 700 employees, 6 logins per day on average means 4200 logins per day. Assume 4 seconds per two-factor login, and you’re looking at 16,800 extra seconds (4.66 hours) a day shifted from productivity to simply logging into your systems.
  • Users have to “have” their “something you have” all the time … Whether that’s an iPhone, a keyfob or a credit card-sized token card.
  • RSA SecureID was HACKED! I know of at least one financial firm that had to turn off two-factor authentication after this came up.
  • People don’t like the extra typing.
  • System Administrators hate the overhead on their systems and the extra points of failure.

As you can start to see, the volume of cons out weigh out the pros, but the comparison isn’t necessarily quantitative. If one point is qualitatively more significant than two hundred contrasting points, which do you pay attention to? If you say “the significant point,” then the question becomes how we quantify the qualitativeness … if that makes any sense.

I had been a long-time hater of two-factor authentication because of my history as a Windows sysadmin, but as I’ve progressed in my career, I hate to admit that I became a solid member of Team Two-Factor and support its merits. I think the qualitative significance of the pros out weigh the quantitative advantage the cons have, so as much as it hurts, I now get to try to sway our senior systems managers to the dark side as well.

If you support my push for further two-factor authentication implementation, wish me luck (’cause I will need it). If you’re on Team Anti-Two-Factor, let me know what they key points are when you’ve decided against it.

-@skinman454

]]> http://blog.softlayer.com/2011/the-pros-and-cons-of-two-factor-authentication/feed/ 9