Mobility Moment

Mobile device and mobile app security are hot topics these days, with everything from data leaks and backdoors to hacked celebrity accounts grabbing headlines with depressing regularity. In the face of so many breaches, experts are calling for the widespread adoption of multi-factor authentication to better secure access to data.

But which multi-factor authentication schemes offer the best balance between security and user convenience?

We put that question to a select group of mobile security experts…

What is Multi-Factor
Authentication?

Multi-factor authentication requires users to provide more than one form of authentication in order to verify identity and access systems or data. The first factor is generally some form of username and password, while the second can range from a PIN to biometrics such as a fingerprint, to physical keys such as Smart Cards and SecureKeys.

Influencer Insights

Bob Tesh

BPS, Product Management & Planning – HP, @RLBobTesh

“Today there are several viable MFA options, each with their own strengths and drawbacks.”

“The priority of multi-factor authentication is to ensure high levels of protection for data, devices and identities without burdening users with yet another combination of IDs and passwords.

Today there are several viable MFA options, each with their own strengths and drawbacks. Virtual tokens in particular provide cost-effective multi-factor authentication and are largely seamless to users, but each organization should do its own research to determine which option is best suited to its needs.”
Will Kelly

Contributing Writer focused on enterprise mobility & BYOD, CNET TechRepublic, @willkelly

“One-time passwords (OTP) offer perhaps the best balance of security and convenience.”

“One-time passwords (OTP) offer perhaps the best balance of security and convenience. When a user logs into an application, the system texts them a one-time password to their mobile device, which they have to enter to complete the authentication. With this method, there are no additional apps to install and manage. Plus, it’s becoming something of an industry standard, and thus more familiar to users with every passing day.”
Jerry Yen

Director of Worldwide Business Personal Systems, HP

“Biometrics authenticate who you are simply through voice, facial, fingerprint and/or iris recognition.”

“As always, it depends. IT professionals prefer multiple factors for greater security, while end users view MFA as an irritating inconvenience – especially for mobile devices. Thus, the most effective – and sustainable – authentication schemes require minimal end user action. Biometrics authenticate who you are simply through voice, facial, fingerprint and/or iris recognition. MFA schemes that combine biometrics with built-in policies, geolocation or passwords can increase security with minimal end user burden – driving adoption and innovation against cyberthreats.”
TK Keanini

CTO, Lancope, @tkkeanini

“Ensuring security for a mobile workforce requires deep consideration of the entire authentication process.”

“Location-based authentication is rather compelling because it operates independent of user action. Ultimately, though, the success of MFA depends on implementation. Poor implementation burdens the user and introduces weaknesses adversaries can exploit. Ensuring security for a mobile workforce requires deep consideration of the entire authentication process. For example, re-authentication when users “forget” passwords should be approached with the same rigor as deterring threat actors.”
Mirko Zorz

Editor in Chief, Help Net Security & (IN)Secure Magazine, @helpnetsecurity

“While both organizations and end users expect seamless yet secure access to information, security is rarely transparent”

“We live in complex times. While both organizations and end users expect seamless yet secure access to information, security is rarely transparent and cybercriminals are increasingly shifting towards highly targeted attacks. This makes multi-factor authentication (MFA) absolutely essential.

An uncomplicated route is to complement your strong password with a one-time password (OTP) generated by an application on your smartphone or delivered to your mobile device. It's quick, straightforward, and simple to setup and use.”