Sure, you can spell enterprise security without the letters M-F-A, but the modern digital enterprise isn't as secure without a strong multi-factor authentication (MFA) strategy. Enterprises are under attack, and credentials are a primary target. Many leading enterprises are enhancing their security and control with MFA, allowing them to move away from a high-risk, password-based security approach and to give their employees, partners, and customers a better user experience. View this slide deck for best practices for a MFA strategy.

1. You Can’t Spell Enterprise Security
Without MFA
Paul Madsen, Principal Technical
Architect
Office of the CTO
Ping Identity
Copyright 2013 Ping Identity Corp. All rights reserved.©
1

2. Agenda
Copyright 2013 Ping Identity Corp. All rights reserved.©
2
•Why
•What
•Which
•When & Where

3. WHY MFA?
Copyright 2013 Ping Identity Corp. All rights reserved.©
3
• Deficiencies & vulnerabilities of one factor
mitigated by another (unless they are dependent)
• Raises the bar for attackers
• Compromise of one factor insufficient to enable
attacker access to sensitive resources
• Voted ‘Easiest to pronounce acronym’ 4 years in a
row!

4. Copyright 2013 Ping Identity Corp. All rights reserved.©
4

5. 5
I come not to bury
passwords but to appraise
them

6. MFA is
Using two or more login
factors in order to
authenticate a user

7. MFA is
Using two or more login
factors in order to
authenticate a user
multiple independent

8. MFA is
Using two or more login
factors in order to
authenticate a user
Dynamically choosing from
multiple independent

9. MFA is
Using two or more login
factors in order to
authenticate a user
Dynamically choosing from
implicit & explicit authentication
multiple independent

10. MFA is
Using two or more login
factors in order to
authenticate a user/
with the optimal balance of security,
usability, and cost
Dynamically choosing from
implicit & explicit authentication
multiple independent

11. MFA is
Using two or more login
factors in order to
authenticate a user/
with the optimal balance of security,
usability, and cost
Dynamically choosing from
implicit & explicit authentication/based on an assessment of risk
(determined by analysis of various
contextual signals and other
considerations)
multiple independent

12. MFA is
Using two or more login
factors in order to
authenticate a user/
with the optimal balance of security,
usability, and cost
Dynamically choosing from
implicit & explicit authentication/based on an assessment of risk
(determined by analysis of various
contextual signals and other
considerations)
multiple independent

13. 13
Authentication

14. Firstly, some secret thou knoweth,
secondly some object thoust have in thy
living, and thirdly some quality of thy
p'rson

15. In practice
•Something you forgot
•Something you left at home
•Something you are nervous
about sharing
15

16. Key Authentication Trends
Trope doesn’t adequately
acknowledge
1. Device as factor
2. Local authentication
3. Contextual verification

17. 17
Device as factor

18. Phones make great *have* factors
•Connected
•Computation
•Storage
•UI

19. Phones make great *have* factors
•Connected
•Computatio
n
•Storage
•UI
In a package a user
won’t leave at home

20. yes
no
Is device authenticated?
no
yes
User
authenticated?
Enjoy public
application
access
Enjoy public
application
access
Authenticating device & user

21. yes
no
Is device authenticated?
no
yes
User
authenticated?
Enjoy partial
application
access
Enjoy partial
application
access
User logs in
from untrusted
device.
User logs in
from untrusted
device.
Enjoy public
application
access
Enjoy public
application
access
Authenticating device & user

22. yes
no
Is device authenticated?
no
yes
User
authenticated?
Enjoy partial
application
access
Enjoy partial
application
access
Enjoy full
application
access
Enjoy full
application
access
Device
Registration
Device
Registration
User logs in
from untrusted
device.
User logs in
from untrusted
device.
Enjoy public
application
access
Enjoy public
application
access
Authenticating device & user

23. yes
no
Is device authenticated?
no
yes
User
authenticated?
Enjoy partial
application
access
Enjoy partial
application
access
Enjoy full
application
access
Enjoy full
application
access
Device
Registration
Device
Registration
User logs in
from untrusted
device.
User logs in
from untrusted
device.
Enjoy public
application
access
Enjoy public
application
access
Authenticating device & user
Enjoy partial
application
access
Enjoy partial
application
access

24. Stand up straight
Copyright 2013 Ping Identity Corp. All rights reserved.©
24
• If relying on device authentication, the
‘device posture’ of that device becomes
paramount
• This ‘device posture’ includes aspects
like PIN, malware, screenshot enabled
etc
• In the enterprise, EMM solutions allow
IT to define & enforce policies over
device posture – and (in emerging trend)
to report current situation into
authentication systems
• Work underway in the Identity Defined

25. 25
Local authentication

26. Local authentication
• Capabilities of phones also make
practical a model where the
verification check is performed
locally, ie on the device
• As used for ‘device unlock’ – the
user logically authenticates to
the device
• Local authentication
(particularly for biometrics) has
privacy advantages – no secrets
on the server

27. FIDO Alliance
Copyright 2013 Ping Identity Corp. All rights reserved.©
27
• The issue with leveraging local authentication is how
– A server can prompt the client to perform an authentication
– How client can ‘prove’ to server that it did so
• FIDO Alliance normalizes the above pattern
• Abstracts away from the server the specifics of the local
authentication on the client via an asymmetric
cryptographic challenge/response pattern
• Inherently multi-factor – must have the private key as well
as the local factor (either know or are)

28. 28
Contextual
verification

29. Contextual verification
• Contextual verification is a model of passively collecting signals & parameters
from the user’s environment and analyzing/comparing them to identify
anomalies (from expected)
• In the context of authentication, supplements (or in some instance replaces)
traditional overt & explicit logins.
• Valuable because it can increase assurance without negative usability
implications
• Signals can be collected via multiple channels & touchpoints, e.g. device,
browser, agents
• Assumption is that attacker unlikely to be able to simulate all signals in order
to impersonate valid user
• Manifests as
• Geofencing Copyright 2014 Ping Identity Corp. All rights reserved.©
29

30. Explicit giving way to implicit
Copyright 2014 Ping Identity Corp. All rights reserved.©
30
Explici
t
Implici
t
Trend
Explici
t
Implici
t

31. 31
Choosing Factors

32. Considerations when picking factors
Copyright 2013 Ping Identity Corp. All rights reserved.©
32
• IT benefits Is the authentication method easy to deploy? Will it require
additional IT resources? Can it work across multiple channels, e.g. online,
telephony, etc?
• Usability Is the authentication method easy to use? Will end users accept the
new process? Can users be expected to have a device capable of supporting a
particular mechanism? Will users be concerned about privacy?.
• Initial costs Is there a cost per user that will grow every time a new user is
added? What is the replacement cost – both for the device and its associated
administrative burden?
• Deployment costs What are the costs associated with deploying the
authentication mechanism. Is client hardware or software required? If so, how
is that distributed to consumers and what are the associated costs?

33. Copyright 2013 Ping Identity Corp. All rights reserved.©
33

34. Analysis
Low
assurance
High
assurance
Poor
usability
Good
usability
Smart cards
OTP
Hardware
token
Passwords
Mobile
authentication app
Device
fingerprinting
Low cost
Medium cost
High cost
SMS OTP

35. Analysis
Low
assurance
High
assurance
Poor
usability
Good
usability
Smart cards
OTP
Hardware
token
Passwords
Mobile
authentication app
Device
fingerprinting
Low cost
Medium cost
High cost
SMS OTP
FIDO?

36. 36
Recommendations

37. Risky business
Copyright 2013 Ping Identity Corp. All rights reserved.©
37
• Risk-based MFA demands that resources be analyzed for the
risk of their compromise
• OMB m04-4 defines a model for assessing risk of an
authentication mistake - determined by
– Potential harm or impact
– Likelihood of the authentication mistake
• ‘Harm’ includes
– Financial loss, damage to reputation, personal safety, civil/criminal
prosecution
• Once risk has been assessed, authentication factors can be
chosen accordingly

38. Break away from password hegemony
Copyright 2013 Ping Identity Corp. All rights reserved.©
38

39. Flexibility
Copyright 2013 Ping Identity Corp. All rights reserved.©
39
• Particularly for consumer space,
provide different options for MFA
factors
• Both to support heterogeneous user
base and to offer fall back mechanisms
if and when a particular factor doesn’t
work, e.g. if a mobile phone is offline
or if the consumer is roaming, fall back
to a generated OTP

40. 40
MFA 2.0

41. MFA 2.0
1. Factor in context
1. Anomalies initially determined by policy, allow for natural learning
future
2. Risk it
1. Choose authentication factors based on assessment of risk
2. Rely on contextual verification when possible
3. Device advice
1. Leverage local authentication and device authentication
2. Be sensitive to device posture
Copyright 2014 Ping Identity Corp. All rights reserved.©
41

42. MFA 2.0
Copyright 2014 Ping Identity Corp. All rights reserved.©
42
Risk & Policy EngineRisk & Policy EngineRisk & Policy EngineRisk & Policy Engine ContinueContinueContinueContinueStartStartStartStart
Active AuthenticationActive AuthenticationActive AuthenticationActive Authentication
DenyDeny
BehaviorBehaviorBehaviorBehaviorContextContextContextContext
ExternalExternal
FeedsFeeds
ExternalExternal
FeedsFeeds
CommunityCommunity
IntelligenceIntelligence
CommunityCommunity
IntelligenceIntelligence
DenyDeny
Behavioural
Feedback
CorrelationCorrelationCorrelationCorrelation
EnvironmentEnvironmentEnvironmentEnvironment
ApplicationApplication
infoinfo
ApplicationApplication
infoinfo PolicyPolicyPolicyPolicy

43. Policy
Data Copyright 2014 Ping Identity Corp. All rights reserved.©
43
IdP
Device
Environment
Authenticati
on
MFA

44. Policy
Data Copyright 2014 Ping Identity Corp. All rights reserved.©
44
IdP RP
Device
Environment
Authenticati
on
MFA Authorization

45. 45
The
M
is table stakes

46. 46
Thanks