The most popular and comprehensive Open Source ECM platform
Let us know more
Security: Multi-Factor Authentication Replacing Standard Passwords
Security is by far the number one concern that most businesses cite when considering a move of any of their data to the cloud. To counter these concerns, cloud vendors are doing all they can to improve security. For example, vendors certifying cloud data centers for SAS 70 compliant, encrypting all web pages and service interactions with SSL, and performing frequent security audits.
But despite these many attempts to improve cloud security, what’s often the achilles heel for cloud security are user passwords. Passwords can often be easily guessed or broken, allowing unauthorized access to cloud services. Increasingly alternative, more secure methods than simple passwords are being adopted by vendors.
Heather Adkins, Google’s manager of information security, went so far as to say that “passwords are dead.”
Cloud vendors are increasingly adopting a more robust kind of identification that requires a second level of validation besides just knowing the password. The technology is called ‘two factor authentication’, or more generally, ‘multi-factor authentication’.
There are three categories of authentication elements:
- Something you know — like a password, PIN, or recognition of an image
- Something you own – like an ATM card, smartphone, or security-specific dongle
- Something unique to you — like a biometric trait (fingerprint, retinal scan, etc)
Two-factor authentication is available by services now like Google Docs. Administrators can optionally enable two-factor authentication for their users’ accounts. Once enabled, users first need to enter their password, but before gaining access to their account, they also need to enter a PIN number that is either sent to them via SMS or generated by an app for them on their mobile device. GitHub, WordPress, and EverNote also use the Google Authenticator or similar method. Twitter has introduced a similar sort of two-factor authentication based on an app running on a mobile device.
