Two-factor authentication is one of the easiest and most effective ways of verifying a user’s identity. The premise is simple: You require users to present more than one set of identifying credentials. This could be a password combined with a face, thumb, or retinal scan, but it doesn’t necessarily have to be that elaborate. Since a physical scan is not practical to do over the internet, you have to use other means. Unfortunately, not everyone knows how to implement this concept properly. So, to help you avoid becoming one of those people, let’s go over some common two-factor authentication mistakes and how to avoid them.
Don’t Make Validation Optional
This point should be obvious, but it needs to be repeated anyway. You need to make it so that users cannot log into your network without undergoing 2-factor identification. This kind of thing becomes completely useless if you give people a way to bypass the authentication. Thus, you need to be using 2-factor authentication for all apps, devices, and accounts. You should also try to close any “loopholes” that may exist. Hiring a penetration tester may prove helpful for that purpose.
Putting Too Much Trust In Text Codes
You have undoubtedly had the experience of entering text codes when logging into a website. A lot of sites use this method of authentication, and there are reasons for that. It’s quick, it’s easy, and just about everyone has a phone. It also helps that most people have only one phone.
Unfortunately, there are a number of different ways in which these text codes can be hijacked or circumvented. There’s nothing wrong with using text codes, but you should understand that they are not especially effective when used alone. They are best used in combination with other security measures, and then they become a lot more effective.
Don’t Let Users See Their Session ID
Websites use several methods to identify users, and one of them is a session ID. This is just a random ID number that is assigned to every user. This number is temporary, as it will only apply to that particular session. This makes it harder for people to masquerade as multiple users or to pull other tricks. However, some people make a big mistake by putting that session ID into the URL of the site.
If someone with sufficient knowledge sees that, there are ways in which they can hijack sessions that use the same ID number in the future. So, there are three things that you can do to remedy this risk. First, use a powerful random number generator as that will make the ID numbers harder to predict. Secondly, validate the session ID on the server side so that it will not be displayed in the URL. You can also use a URL filter to remove that info from the display.
Neglecting Form Validation and Sanitization
Most websites have some kind of form that can be sent to the administrators, and yours is probably no exception. Unfortunately, these forms can be used as delivery vectors for malware and other forms of cyber-attack. In particular, there is a danger of hackers using cross-site scripting (also called XSS) to perform all sorts of mischief. Email forms can also be hijacked in a similar way.
XSS works by using scripts, small and simple programs that perform specific functions. Most websites have a variety of scripts that are used to make the site work, but it is possible for users to insert malicious scripts into your site by using feedback forms. You can defeat this by using proper validation and sanitization procedures on every form document submitted.
So, make sure you use email address formatting for your email forms. This auto-formatting will make sure that certain things simply cannot get through. It is very hard for someone to inject malicious code through a form without changing the format of the data. Therefore, an auto-formatting solution is pretty effective. You also want to make sure that your forms cannot be submitted with empty spaces or any other irregularities. Finally, you can use a variety of form validation libraries to provide yet another filtering mechanism. Use all of this in combination with two-factor user identification for all your forms.
Not Using Encrypted Verification Codes
As we said earlier, text verification codes can be hijacked, and that is largely because they are not encrypted. However, you can use what they call “push codes” to send a more secure verification message. They use encrypted HTTPS internet connections rather than unencrypted phone lines, and that is a lot more secure. In fact, if your situation allows for it, you should probably use push codes to replace standard SMS codes entirely.
Deploying At A Single Point
One important point to remember is this: You don’t just deploy 2-factor authentication at one point. For instance, some people just put 2FA on the site login page and they think that’s all they need. But, as we have said from the start, there are many ways in which a single security measure can be circumvented.
You need multiple layers of security, like having multiple walls around a fortress. So, make sure you are using 2-factor authentication every time someone utilizes your company’s IT resources in any way. Every point of entry must be guarded. Otherwise, it’s kind of like locking your front door while leaving the back door open.
Conclusion
While the basic concept of 2-factor authentication is simple, there are multiple ways in which people can defeat its protections. As you may have noticed, most of these common mistakes involve a failure to close one or more of those loopholes. The good news is that 2-factor authentication is effective when used correctly, and when combined with other security measures within a comprehensive strategy. If your company needs help implementing these kinds of protections, but you don’t know where to begin, you can call PCH Technologies at (856) 754-7500.