What is Multi-factor Authentication?

Multi-factor authentication (MFA) is a security approach that requires a user to provide at least two authentication factors (i.e., login credentials) to prove their identity and gain access to a facility. The purpose of MFA is to restrict unauthorized users from entering a facility by adding extra layers of authentication to the access control process. A well-thought-out MFA strategy aims to strike a balance between user experience and increased security at the workplace.

In a research report, it was revealed that over 57% of businesses across the globe use MFA to protect both their physical and virtual assets.

MFA uses two or more independent forms of authentication, including:

  1. Knowledge factors: What the user knows (password and passcode)
  2. Possession factors: What the user has (key fob, hardware token or access card)
  3. Inherence factors: What the user is (biometric)

This article explains the benefits of MFA and a range of adaptive MFA methods that help businesses restrict unauthorized users from accessing a facility. 

Benefits of Multi-factor Authentication

MFA gives users several benefits, including stronger security and meeting compliance standards.

Stronger Form of Security than Two-factor Authentication

Two-factor Authentication (2FA), a subset of MFA, requires users to enter just two factors to authenticate their identity. For example, a combination of a password and a hardware or software token is sufficient to gain access to a facility when 2FA is being used. MFA using more than two tokens makes access even more secure.

Meets Compliance Standards

Some state and federal laws require enterprises to use MFA to meet compliance standards. MFA is mandatory for high-security building premises such as data centers, healthcare centers, electricity boards, financial institutions and government agencies.

Reduces Lost Business and Operational Costs

The average cost of a physical security compromise in 2022 is $3.96 million in the United States. The lost business costs are attributed to factors such as business disruption, loss of customers and loss of revenue. Since the implementation of MFA helps enterprises avoid physical security compromises, the possibility of business disruption and loss of customers, which may lead to lost business costs, would be reduced significantly. Furthermore, MFA decreases the need for organizations to hire security guards and install other physical security barriers at each access point. This leads to reduced operational costs.

multifactor authentication

Adaptive Multi-factor Authentication Credentials in Access Control

Adaptive MFA is an access control approach that uses contextual factors such as day of the week, time of the day, user’s risk profile, location, multiple login attempts, consecutive login failures and many more to determine which authentication factors to use in a particular situation.

Security admins can choose a combination of two or more security keys. Below are a few examples of such keys.

NFC

Near-field communication (NFC) sends radio waves to activate the antenna in a receiving device (i.e., the reader). NFC facilitates contactless access through gates, doors, barriers and turnstiles without the user needing to touch the access reader. Security admins can use the NFC key cards or mobile devices as one of the access credentials to enable MFA for employees to access a facility.

Let’s look at how NFC key fobs are used to enable MFA below:

  • Step 1: The user scans his or her NFC key fob or mobile device on the NFC reader.
  • Step 2: The NFC reader communicates with the access controller to authenticate the user’s identity.
  • Step 3: Upon authenticating the key fob, the controller will send a push notification to the user’s smartphone.
  • Step 4: The user should confirm his identity by clicking the push notification.
  • Step 5: After the user clicks the push notification, the controller will send a signal triggering the door to open.

Mobile Credentials

Mobile access control is one of the most convenient and secure methods of access control for enterprises. It enables employees and visitors of an enterprise to use their mobile phones to unlock doors.

Security admins can use mobile credentials to enable MFA for their properties. For instance, they may configure the access control system in a way that the employees should first use their mobile credentials and then attend an automatic phone call received on their mobile device to answer a couple of security questions.

The three authentication methods the security admin used for this access policy are:

  1. The authenticator app
  2. The SIM card or phone number of the user
  3. Security questions

This mechanism makes sure that unauthorized users will not be able to access a facility even if they hack the mobile credentials because the SIM card and security questions will add extra layers of security.

Biometric Identification

Many enterprises are using biometrics access control to restrict unauthorized users from entering the building premises. The most popular biometrics are fingerprint, facial recognition, retina scanning and palm vein pattern.  

Security admins can use biometrics in conjunction with other credentials to enable MFA. For instance, access readers can be configured in a way that the users should scan their fingerprints first and then enter the OTP received as a text message (SMS) on the keypad reader to access the facility.

RFID

RFID technology uses radio waves to communicate between the chip embedded in the RFID tag and the RFID reader. The controller validates the RFID tag with its database and grants or rejects the user access to the facility.  Security admins can use RFID tags while setting up MFA for their enterprise. For instance, they can configure the access control system in a way that users present their RFID card first and then verify their identity through facial recognition technology to gain access to a resource.

Role of Card Readers in MFA

Enterprises use different types of card readers, including proximity card readers, keypad readers, biometric readers and others depending on their security needs.

To enable MFA, you can use a combination of two or more access card readers.

  • Level 1 Security: At level 1, you may place a keypad reader so that users enter a passcode and move toward the next level of security.
  • Level 2 Security: At level 2, you may place a biometric fingerprint scanner where users authenticate themselves by scanning their fingerprints.
  • Level 3 Security: At level 3, you may place a facial recognition reader where users authenticate themselves by scanning their faces.

This three-level access policy facilitates MFA and restricts unauthorized users from entering a facility even if they steal the personal identification number (PIN) from the authorized user.

Genea Secures Your Facility with MFA

MFA will significantly improve the security of property. Depending on the requirements, you can use two or more authentication factors for identity verification of users before granting them access to facilities.

Setting MFA for your critical assets will be easier if you have a cloud-based access control system in place. Genea’s cloud-based access control works with a range of access credentials to facilitate MFA for additional security. No matter if you are using NFC key fobs, biometrics or RFID tags, Genea’s access control will accommodate it all.

Genea’s integration with identity managers such as Okta and Microsoft Azure Active Directory will help you automate the process of creating and removing access credentials for users and facilitate single sign-on (SSO) for admin access to management.

Book a demo to learn how Genea’s cloud-based access control can help you set up MFA for added security.