What Are Multi-Factor Authentication (MFA) Services?

While MFA services are a significant improvement over login protocols that require only usernames and passcodes, traditional MFA is not foolproof. MFA services that use the FIDO2 standard are more impervious to being hacked, but they are more complex to use and manage as well. That’s why Akamai offers MFA services that deliver superior security while providing a frictionless user experience.

Eighty percent of hacking-related data breaches involve stolen user credentials or poor password hygiene, making superior authentication technology essential to enterprise security. The standard approaches to authentication come with significantly different levels of risk, and it’s critical to understand the differences before investing in authentication solutions.

High risk: username and password authentication

When organizations rely solely on single-factor usernames and passwords to verify user identities, they are highly vulnerable to attack. Login details can easily be stolen, guessed, or harvested. Malicious actors can easily bypass this level of security through direct access if they have the employee credentials, or through credential stuffing if they know the usernames. To compound the problem, many employees use the same passwords for their personal accounts. If these personal credentials are compromised, attackers will use the stolen passwords to target corporate accounts.

Medium to high risk: standard MFA services

MFA functionality improves enterprise security by requiring a second level of authentication to verify a user. The second factor may be something a user knows like a PIN, something they have like a device or one-time password, or something they are. This last factor may rely on biometric data such as facial ID or a fingerprint. While MFA technology greatly reduces the risk of a breach, hackers may still successfully gain access to systems through phishing, social engineering, transparent proxies, SIM swapping, and other techniques.

Low risk: FIDO2-based MFA services

The most effective authentication security is provided by MFA services that are built on FIDO2, the strongest standards-based authentication method available. This technology uses cryptographic login credentials to authenticate users and supports the eventual evolution to fully passwordless authentication. By protecting login credentials from phishing or social engineering attacks, FIDO2-based solutions solve the security vulnerabilities of traditional MFA services.

The downside of FIDO2 MFA technology is that it requires physical FIDO2 security keys for every user, adding considerable cost and complexity to the authentication process. That’s why Akamai has engineered a next-generation MFA offering that reduces cost and complexity while also minimizing risk.

Akamai MFA is a workforce multi-factor authentication solution that provides strong secondary authentication to cloud, web-based, on-premises, SaaS, and IaaS applications. Akamai simplifies the FIDO2 authentication process by replacing physical hardware tokens with push notifications on a smartphone app. End-to-end cryptography and a sealed challenge/response flow provide superior security, making the authentication process unsusceptible to phishing and social engineering attacks.

With MFA services from Akamai, you can:

• Quickly deploy a superior MFA solution. Users can download the Akamai MFA app onto existing smartphones, eliminating the delays associated with distributing physical security keys or issuing compatible hardware.
• Provide users with a frictionless experience that leverages their own smartphone and uses familiar push notifications.
• Minimize the risk of breach by deploying a FIDO2-based solution that eliminates the impact of phishing and social engineering attacks.
• Reduce the total cost of ownership by avoiding the need to purchase, replace, and maintain additional hardware.
• Enable Zero Trust networking by deploying the strongest available authentication and authorization protocols.
• Future-proof investments in MFA services with a FIDO2-based, cloud MFA solution that’s designed to evolve to support future use cases.

Akamai MFA works with a primary identity provider (IdP) such as Microsoft Azure AD or Okta to deliver stronger authentication security. When a user provides the correct username and password at login, the IdP connects to Akamai MFA to request that the sector factor request is generated. Akamai MFA renders a page that allows users to select a second factor, and then sends a challenge — a phish-proof push, for example — to an app on the user’s smartphone. When the user acknowledges the request, Akamai MFA passes control back to the IdP, which then allows the user to access the requested application or service.

Additional features of Akamai MFA include:

• Configurable options that allow organizations to choose authentication factors for specific use cases, including phish-proof push, standard push, time-based one-time password (TOTP), and Short Message Service (SMS).
• Automated user provisioning workflows using SCIM (System for Cross-domain Identity Management) to keep administrators informed of authentication events.
• Self-service user enrollment with multiple low-friction methods to simplify enrollment and device registration and reduce the burden on administrators.
• Integration with IdP solutions such as Microsoft Azure, Okta, and Akamai IdP.