SatyaDev Addeppally, Author at Akku

The What, Why and How of Two-factor Authentication (2FA): Decoded

Whether or not you know what it is called, you have likely used 2FA at least once in your life online.

Remember the time you tried logging into your email account from a new device and your email service provider sent you an SMS with a PIN (OTP), to re-validate that it was actually you attempting to login? You would have been allowed access to your inbox only after you entered the correct OTP.

Or the time you tried to transfer money to someone through internet banking. Even though you already entered your customer ID and password, your bank’s application would want to make sure that someone else hadn’t stolen your credentials. They do this by sending you an email with a PIN or a link to click on, for additional validation.

This is exactly what 2FA or two-factor authentication solution is all about.

Known by many names – two-factor authentication, two-step authentication, two-step verification or dual factor authentication, 2FA refers to a second level of authentication added on in order to enhance security inherent to a login process. This is in addition to the username and password step, which is relatively susceptible to hacking.

When two or more layers are added to the login authentication process, it’s also known as multi-factor authentication or MFA.

Types of MFA security

A two or multi-factor authentication process typically asks you for ‘something you know’ in the first step, such as your email ID/username and password.

In the second step, it may ask you to authenticate your identity with ‘something you have’ or ‘something you are’.

Something you know – the knowledge factor:

This could be your username and password, as in any ordinary login process, or it could be a PIN.

Something you have – the possession factor:

This traditionally referred to hand-held token items, such as smart cards or Yubikeys embedded with a certificate to identify the user. Nowadays, a ‘possession’ could also be your smartphone, containing an app which sends a push notification or a TOTP. This is especially beneficial since tokens like smart cards are relatively more prone to being lost, stolen or misplaced.

Something you are – the inherence factor:

Biometric authentication could involve the scanning of a biological element that is exclusively yours – such as your fingerprint, hand geometry, retina, iris and so on. Voice recognition can also be used.

Two-factor authentication for your business

If your business relies on highly sensitive data or handles personal data of clients, you need to have an information security management system in place. This is especially crucial these days as several governments are imposing stringent regulations to ensure that the privacy of their citizens is not compromised. Some business standard certifications also require security compliances to certify your business and, therefore, it is important for you to protect sensitive data with more than just single-factor authentication (SFA).

By setting up 2FA or MFA security in all your business applications, you are assured of a higher degree of protection. In this manner, even if somebody does steal, guess or hack a password or even a list of passwords, through a brute force attack, they will be stopped at the second level as they attempt to log in to a specific individual’s account.

Multi-factor authentication solutions by Akku

When your business uses multiple applications, it may be both expensive and difficult to set up and streamline multi-factor authentication in each. That is where Akku comes in, with the promise to address all these concerns once and for all.

Once you opt for Akku, it becomes a common identity provider (IdP) across all your enterprise applications and creates a single sign-on (SSO) page through which your users can access them. Having brought all of your applications to a single platform through the SSO, Akku then seamlessly implements the multi-factor authentication functionality across them all.

With Akku, users can decide to use any of the following options as their second factor for re-validating their identity, giving them the power of choice:

- A push notification delivered to their smartphone through the Akku mobile app

- A time-based OTP (TOTP) which expires in 30 seconds through an authentication app (such as Google authenticator)

A PIN sent through an SMS to their registered mobile number

Interested to know more? Visit www.akku.work or get in touch with us through sales@akku.work

Bolster Data Security with a Powerful and Flexible Password Policy

An array of information being stored online comes with major security risks. Therefore safeguarding data is an important consideration at any organization. And the security of your data relies heavily on the strength of your users’ passwords. The stronger your passwords, the more secure your data! It is important for administrators to drive a strong password policy enforcement, as it is the first layer of defence against black hat hackers and scammers.

A password policy is a set of rules created to upgrade an application’s security by requiring its users to frame a strong password and to utilize it in an appropriate way.

Why is Securing your Border Vital?

In today’s scenario setting up unique passwords for multiple applications is a burden for any user. Most users rely on using a single password for multiple applications, which can put the organization’s data at risk.

This makes implementing a strong password policy essential in protecting your data. Additionally, setting a Password Policy forms a part of the policies or rules for an organization to comply with ISO and PCI certifications.

Top Four Factors for Password Policies

Enforcing a strong password policy in an organization is an uphill task. There are some fundamental norms which are followed by a majority of organizations.

1. Length: The longer the password, the more difficult it is to crack. Set a minimum of 8 characters for your users’ passwords.

2.Complexity: The level of security depends on the complexity of the password framed. Passwords must have a mix of uppercase characters (A-Z), lowercase characters (a-z), numbers (0-9) and punctuations ( eg. !, #, $,*).

3.Expiration: A best practice in improving password security is to have a periodic password expiry. Most often the validity is 30/45 days and at the end of expiry date, the user is forced to change their password.

4.Uniqueness: Require users to set a unique password that has not been used previously when they reset their password.

How Can a Forgotten Password be Securely Retrieved?

When a user logs in with the right password, he is permitted to access the organization’s applications. On the other hand, when a user logs in with incorrect credentials, if the organization allows SSPR (Self Service Password Reset) then the system prompts the user to reset the password on his own.

Here’s how it works – a window pops up with a certain number of questions, and when the user answers all the questions correctly, he is permitted to reset the password. However, this process leaves the door open to social engineering attacks by black hat hackers.

A safer approach is to disallow SSPR in the password policy of an organization. In this scenario, the only way to reset a user’s password is to reach out the admin – this is safer and does not allow any intrusion through social engineering, and therefore reduces the data security threat.

How can a Forgotten Password be Securely Retrieved

I shall write more about SSPR and social engineering in my next article.

Enforce a strong custom Password Policy across your organization using Akku’s Password Policy Enforcement feature which brings it all together for improved security.

YouTube Usage at the Office is No Longer a Worry!

Using YouTube at the office is often viewed negatively, both because of it results in heavy bandwidth consumption, and in reduced employee productivity. At the same time, YouTube is a huge digital library where it is possible to access content on almost any subject.

In today’s fast-moving business scenario, YouTube is one of the best platforms to enhance knowledge and skills. While lectures and training may tend to get boring, digital learning is a great way to build interest. YouTube has an enormous range of content from various categories.

Training and development is a department for which YouTube is an essential and effective resource. Trainers can train employees with e-learning videos from YouTube at no cost, and can also recommend videos related to their work and skills to help them perform better.

So completely blocking access to YouTube is not the right solution either, since you will end up restricting the biggest learning platform for your employees.

Providing access to or blocking YouTube tends to be viewed to be an all or nothing exercise – but there is a middle path. Implementing a YouTube filtering solution on your cloud can get you the best of both worlds.

What is YouTube Filtering?

YouTube Filtering is an interesting feature of select Identity and Access Management solutions, which can whitelist specific videos from YouTube based on categories and channels.

YouTube filtering restricts people from accessing irrelevant content on YouTube. Restricted and Moderate Restricted modes can also be activated using a YouTube filter – the Restricted mode helps to block all 18+ content from YouTube while the Moderate Restricted mode prevents employees from liking, commenting on or sharing videos.

How does it work?

YouTube Filtering works with the help of a proxy server which reads the metadata consisting of the channel name, category, channel ID, file name and so on.

For instance, when the user is searching for a video on YouTube, the proxy server will read the metadata to confirm whether the channel is whitelisted, based on which it displays the video. If the channel is not whitelisted, an error is displayed to the user that access to the video is not permitted.

Leverage the power of YouTube for your organization without worrying about the downside with Akku’s YouTube Filtering feature.

A Single Login To Access All Your Applications

Logging on to different applications using different user credentials every single time is frustrating, isn’t it? The use of a Single Sign On (SSO) application makes it easy to access all your applications with just a single set of login credentials. The SSO acts as the identity provider – a common platform to handle user identity and access across all your applications – and also provides authentication, authorization and access control.

Single Sign On solution offers a secure and convenient way to manage access credentials and user provisioning.

Advantages of Single Sign On (SSO)

Reduce Your Help Desk Costs

Gartner’s research says that about 50% of all calls made to help desks are requests for resetting passwords. In this scenario, deploying a Single Sign On application reduces the time, effort and cost spent by your help desk, resulting in savings for your organization.

User Experience

Through automated login using Single Sign On, users can switch between applications without having to login to each applications each time. This saves employee time and increases productivity.

Reduce Password Fatigue

Users don’t need to remember and manage multiple passwords – SSO reduces the number of passwords to one and makes it much simpler to remember and manage.

Easier Accounts Management

SSO gives clear visibility on what access is permitted for whom. It also helps in improving the speed of adding and disabling the accounts of outgoing employees.

Right Access To The Right People

Admin users can provide or deny access to specific users. For instance, if a particular user in a department wants an application to work on the admin can give access only to that person instead of giving it to the team which could result in confusion.

How does it work?

An SSO acts as an identity provider, acting as a common platform to manage identity and access rules across all of an organization’s cloud apps. When a user connects to the service provider to authenticate their identity, it transfers authentication to the identity provider. The identity provider validates the user’s credentials, and then sends a SAML token to the service provider for accessing the application.

Akku packs a powerful Single Sign On function whose customized SAML enables you to integrate a highly secure Single Sign On (SSO) with any cloud or in-house application, developed on any platform, including support for your intranet.

So, why continue to be frustrated with multiple passwords and multiple user accounts to access multiple applications? Make access easier for users and control easier for administrators with Akku.