Credential theft is now at an all-time high and is responsible for more data breaches than any other type of attack. 

With data and school processes now largely cloud-based, a user’s password is the quickest and easiest way to conduct many different types of dangerous activities.

Being logged in as a user (especially if they have admin privileges) can allow a criminal to send out phishing emails from your school account to your teachers, parents, students, and community. The hacker can also infect your cloud data with ransomware and demand thousands of dollars to give it back.

How do you protect your online accounts, data, and school operations? One of the best ways is with multi-factor authentication (MFA).

It provides a significant barrier to cybercriminals even if they have a legitimate user credential to log in. This is because they most likely will not have access to the device that receives the MFA code required to complete the authentication process.

WHAT ARE THE THREE MAIN METHODS OF MFA?

When you implement multi-factor authentication at your school, it’s important to compare the three main methods of MFA and not just assume all methods are the same. There are key differences that make some more secure than others and some more convenient.  At a high lever, there are three main methods of implementing MFA in your school or district, and they each have their own advantages and disadvantages.  Let’s take a look at these 3 different methods.

SMS-BASED

The form of MFA that people are most familiar with is SMS-based. This one uses text messaging to authenticate the user.  The user will typically enter their mobile number when setting up MFA. Then, whenever they log into their account, they will receive a text message with a time-sensitive code that must be entered.  You have most likely been using this for your mobile banking logins as most banks are mandating this type of authentication.

ON-DEVICE PROMPT IN AN APP

Another type of multi-factor authentication will use a special app to push through the code. The user still generates the MFA code at login, but rather than receiving the code via SMS, it’s received through the app.  This is usually done via a push notification, and it can be used with a mobile app or desktop app in many cases.  At Vinson, we are seeing most of our clients use free solutions such as Google Authenticator and Microsoft Authenticator, or paid solutions such as Duo, depending on the district.  

SECURITY KEY

The third key method of MFA involves using a separate security key that you can insert into a PC or mobile device to authenticate the login. The key itself is purchased at the time the MFA solution is set up and will be the thing that receives the authentication code and implements it automatically.  The MFA security key is typically smaller than a traditional thumb drive and must be carried by the user to authenticate when they log into a system. At Vinson we have seen the Yubikey being deployed in many of our districts.

Now, let’s look at the differences between these three methods.

MOST CONVENIENT FORM OF MFA?

Users can often feel that MFA is slowing them down. This can be worse if they need to learn a new app or try to remember a tiny security key (what if they lose that key?).  This user inconvenience can cause companies to leave their cloud accounts less protected by not using multi-factor authentication.

If you face user pushback and are looking for the most convenient form of MFA, it would be the SMS-based MFA. Most people are already used to getting text messages on their phones so there is no new interface to learn and no app to install.

The SMS-based is actually the least secure because there is malware out there now that can clone a SIM card, which would allow a hacker to get those MFA text messages.

One thing to consider with this form of MFA is that it will require the user to (1) have a mobile phone, and (2) consent to using that mobile phone for MFA.  This may be a concern, so make sure to carefully consider this during your discussions.

MOST SECURE FORM OF MFA?

If your company handles sensitive data in a cloud platform, such as your online accounting solution, then it may be in your best interest to go for security.

The most secure form of MFA is the security key.

The security key, being a separate device altogether, won’t leave your accounts unprotected in the event of a mobile phone being lost or stolen. Both the SMS-based and app-based versions would leave your accounts at risk in this scenario.

However, this option will obviously require your users to use a separate device for MFA other than their phones.  With the near ubiquity of MFA solutions that use your phone, it may be seen as overkill for a school’s security posture.  Plus, it’s an additional cost that will need to be incurred by the district, in addition to the overall management of the devices, including replacing lost devices, etc.  

WHAT’S IN BETWEEN?

So, where does the app with an on-device prompt fit in? Right in between the other two MFA methods.

Using an MFA application that delivers the code via push notification is more secure than the SMS-based MFA. It’s also more convenient than needing to carry around a separate security key that could quickly become lost or misplaced.  Because of this balance between security and convenience, this is where we generally advise our districts to look for solutions.

EFFECTIVENESS?

A Google study looked at the effectiveness of these three methods of MFA at blocking three different types of attacks. The security key was the most secure overall, but only slightly better than the app.

Percentage of attacks blocked:

• SMS-based: between 76 – 100% 

• On-device app prompt: between 90 – 100%

• Security key: 100% for all three attack types

LOOKING FOR HELP SETTING UP MFA AT YOUR SCHOOL OR DISTRICT?

Multi-factor authentication is a “must-have” solution in today’s threat climate, especially when you consider that most, if not all, of the cyber insurance carriers are making this a requirement.   Let’s discuss your barrier points and come up with a solution together to keep your school environment better secured.

Article adapted with permission from The Technology Press.