Akamai MFA supports standard platform authenticators (from Microsoft, Apple, and others) and roaming authenticators in the form of physical security keys. Akamai’s differentiator, however, is that the Akamai MFA mobile app turns a smartphone into a roaming FIDO2 authenticator — the FIDO2 phone security key. This capability delivers the following benefits:

• FIDO2 security without the cost of physical FIDO2 security keys
• Delightful end-user experience with an easy-to-use push notification presented on the smartphone
• Minimal administrative effort, as there is only one authentication service to support, not one each for Windows and Apple operating systems

The Akamai MFA solution protects against employee account takeover by using FIDO2-based authentication factors to verify that end users’ logins are legitimate. Traditional authentication factors such as one-time passwords, passcodes, SMS, time-based one-time password, and push notifications have weaknesses that attackers can exploit to take over an employee account. FIDO2-based authentication factors do not have these weaknesses and are impervious to SIM-hijacking, machine-in-the-middle replay, push fatigue, and other exploit methods. You can further improve access management by adding biometric factors to the FIDO2 authentication factor.

Akamai MFA offers different authentication factors to support any use case. You can select the authentication factors you need for identity verification, including FIDO2 phone security key, other FIDO2 authenticators, standard push, time-based one-time password, one-time password or SMS. To further increase the security of the authentication process, you can configure the service to use biometric factors, such as facial recognition, in addition to the FIDO2 phone security key and standard push factors.

Cyberattacks often begin with threat actors who target identity and access management as the starting point. One common approach is to use sophisticated phishing emails that send employees to fake corporate login pages. These phishing emails will often be amplified with social engineering techniques — for example, calling the employee and claiming to be from IT. The threat actors then use the harvested user credentials to log in to the real corporate login page. In the event that standard push multi-factor authentication is being used, the employee will receive the push notification. If they accept this notification, then the threat actor has gained access.

Akamai MFA is based on FIDO2 authentication standards, which means that even if a threat actor has obtained an employee’s login credentials, the FIDO2 push notification will not be received by the employee. This ensures that threat actors cannot use compromised user credentials to gain user access.

Yes, you can use Akamai MFA to provide a multi-factor authentication solution to increase the security of your authentication policies for your VPN. The PacketFence Gateway is a software component that you can install in your environment to provide integration between VPN servers and other network devices. The integration uses Remote Authentication Dial-In User Service (RADIUS), Lightweight Directory Access Protocol (LDAP), or Microsoft Active Directory (Microsoft AD) for primary authentication, and the ​Akamai MFA​ service as the secondary authenticator. By integrating ​Akamai MFA​ with PacketFence Gateway, you establish secure communication among users who are off-premises and use the VPN server or other network elements, such as firewalls and the corporate network.

The primary difference between multi-factor authentication and two-factor authentication is the number of factors required for authentication. Two-factor authentication uses two factors — for example, username and password. Multi-factor authentication uses more than two factors — for example, a username, password, and a one-time password, which provides a higher level of secure access.