Is One Form of MFA Better Than Another?

Approximately 77% of cloud account breaches in a Business Tech Environment are caused by compromised credentials.

Due to the rise of cloud account use, credential theft has become a major focus of online criminals.

For example, theft of a person’s usernameand password for an online account has now become the number one attack ploy used in phishing emails.

Whether you’re trying to protect your Microsoft 365 account or Google Workspace account, safeguarding user logins is critical.

This can be challenging when users are prone to bad password habits.

Some of the common bad password habits that enable credential compromise include:

Reusing the same password for multiple accounts
Using Weak Passwords
Storing Passwords in non-secure ways (like an unprotected Word Document Or Excel Sheet)
Sharing Passwords with Other Users

The best way to combat poor user password security is to enable multi-factorauthentication for all your accounts.

MFA can block nearly all fraudulent sign-in attempts because the hacker will not typically have access to thedevice that receives the MFA code.

Adding the second factor of “what you have”significantly increases your security.

By how much?

This depends upon the type of multi-factor authentication you use.

There are three standard methods, which we’ll review below.

Each can provide a great deal of protection, but some are more secure than others.

On the flip side of that, some are also less convenient than others.

Typically, a company will need to balance convenience and security when choosing the type of MFA they want to implement.

If MFA is too inconvenient, then users might look for workarounds, defeating the purpose which is to improve your cloud security.

23%of surveyed individuals said that multi-factor authentication is very inconvenient.

Comparing 3 Methods of Multi-Factor Authentication

In the comparison below, when we get tos ecurity, we’ll be using statistics from a Google-sponsored survey on the effectiveness of different MFA methods.

Which Type Of MFA Is Better than the other image 1

Method 1: Receiving the Code by SMS/Text

Receiving an MFA code by text message is by far the most common method.

It also tends to be the most convenient for people because they’re used to receiving text messages on their phones.

This method has the lowest level of security of the three.

The reason for this is that some forms of mobile malware can infect a device and replicate a SIM card.

This would allow the hacker to receive any messages that that phone received.

Google Study Results for Method 1:

Effectiveness agains targeted attack: 76%
Effectiveness against bulk phishing attack: 96%
Effectiveness against automated bot attack: 100%

Method 2: Receiving Code by Device Prompt/App

Another method that is used often for MFA is using an authentication app on a device.

The code is not tied to a mobilephone number in this case but will typically be received on the device via adevice prompt.

This method is slightly less convenient than SMS because users will have to install an authenticator app and then attach their cloud accounts that are using MFA to that service.

The method is more secure than SMS because the code isn’t coming into a specific mobile number.

Google Study Results for Method 2:

Effectiveness against targeted attack: 90%
Effectiveness against bulk phishing attack:99%
Effectiveness against automated bot attack: 100%

Method 3: Using a Security Key to Authenticate

The most secure method of multi-factor authentication is the use of a security key.

These are very small gadgets,smaller than a USB drive in many cases, that can be inserted into computers,laptops, and mobile devices to authenticate a login.

This is the costliest method because companies do need to purchase the security keys for their users.

They also must deal with lost security keys from time to time.

Just like authentication apps,you will need to set up your accounts with the security key site.

While less convenient, this is a good method to use for users that have access to particularly sensitive information like company bank accounts because it’s the most secure.

Google Study Results for Method 3:

Effectiveness against targeted attack: 100%
Effectiveness agains bulk phishing attack: 100%
Efectiveness against automated bot attack: 100%

Need Help Improving Your User Authentication Process?

Don’t leave your accounts at risk! Xpresste xcan work with your Australian business to put password authentication methods in place that secure your accounts without hampering user workflow.

‍