Pros and cons of a multi-factor authentication mobile app
MFA can improve the security of an app by using a layered approach rather than one that relies on passwords alone. To know whether it's right for your app, weigh its pros and cons.
Multi-factor authentication is essential for any enterprise app that stores, processes or accesses sensitive corporate data or personally identifiable information -- but its adoption comes with challenges that are well beyond those that accompany a username/password approach.
A multi-factor authentication mobile app requires users to provide multiple independent credentials to use the app or access its data. Multi-factor authentication (MFA) takes a layered approach to security that makes it more difficult for unauthorized individuals to gain access to sensitive information.
What is MFA, exactly?
Acceptable credentials for a multi-factor authentication app are generally divided into three categories: what the user knows -- knowledge -- what the user has -- possession -- and who the user is -- inheritance.
The knowledge category includes credentials such as passwords, PINs or answers to secret questions. The possession category includes items such as ID cards, key fobs, one-time password tokens or the mobile device itself. The inheritance category refers to forms of biometric authentication, including retina and fingerprint scans.
Multi-factor authentication takes a layered approach to security that makes it more difficult for unauthorized individuals to gain access to sensitive information.
Two-factor authentication (2FA) is usually considered a type of MFA, although 2FA and MFA are sometimes treated as different approaches. Regardless, an effective MFA strategy should include credentials from multiple categories. For example, an app that requires a high degree of security might require a password and security token, in addition to a registered smartphone.
Because a multi-factor authentication mobile app requires multiple credentials, authentication is more secure than a password alone, which hackers can easily compromise. Even an encrypted password is vulnerable to brute-force attacks or exposure in other ways.
Every factor added to the authentication process results in an additional level of protection. If one factor is compromised, the others are still in place to protect the sensitive data.
Enabling a multi-factor authentication mobile app can also help address compliance issues, whether at the local, state or federal level. In fact, some regulations require that organizations use MFA to safeguard protected data. Even if regulations don't require MFA, it can be an important component of any security strategy.
MFA challenges
Every additional authentication factor requires more work on the end user's part. It can be difficult enough to remember and manage passwords. But adding tasks like dealing with authenticators can affect productivity and lead to frustration, especially when users run into snags or have to repeat multiple steps each time they access their apps.
It is no small task to integrate MFA technologies into an app. It requires DevOps resources to both develop and manage MFA-related technologies and can raise issues related to system implementation and integration.
Even so, an organization that is serious about security has little choice but to implement a multi-factor authentication mobile app. For now, it is the accepted best practice to authenticate users and protect sensitive data.
