Authentication methods used for network security

While just one facet of cybersecurity, authentication methods are the first line of defense. This is the process of determining whether a user is who they say they are. Not to be confused with the step it precedes—authorization—authentication is purely the means of confirming digital identification, so users have the level of permissions to access or perform a task they are attempting.

There are many authentication methods, ranging from passwords to fingerprints, to confirm the identity of a user before allowing access. Doing so adds a layer of protection and prevents security lapses like data breaches, though it’s often the combination of different types of authentication that provides secure system reinforcement against possible threats.

Authentication methods

Authentication keeps invalid users out of databases, networks, and other resources. These types of authentication use factors, a category of credential for verification, to confirm user identity. Here are just a few authentication methods.

Single-Factor / Primary Authentication

Historically the most common form of authentication, Single-Factor Authentication, is also the least secure, as it only requires one factor to gain full system access. It could be a username and password, pin-number or another simple code. While user-friendly, Single-Factor authenticated systems are relatively easy to infiltrate by phishing, key logging, or mere guessing. As there is no other authentication gate to get through, this approach is highly vulnerable to attack.

Two-Factor Authentication (2FA)

By adding a second factor for verification, two-factor authentication reinforces security efforts. It is an added layer that essentially double-checks that a user is, in reality, the user they’re attempting to log in as—making it much harder to break. With this method, users enter their primary authentication credentials (like the username/password mentioned above) and then must input a secondary piece of identifying information.

The secondary factor is usually more difficult, as it often requires something the valid user would have access to, unrelated to the given system. Possible secondary factors are a one-time password from an authenticator app, a phone number, or device that can receive a push notification or SMS code, or a biometric like fingerprint (Touch ID) or facial (Face ID) or voice recognition.

2FA significantly minimizes the risk of system or resource compromise, as it’s unlikely an invalid user would know or have access to both authentication factors. While two-factor authentication is now more widely adopted for this reason, it does cause some user inconvenience, which is still something to consider in implementation.

Single Sign-On (SSO)

With SSO, users only have to log in to one application and, in doing so, gain access to many other applications. This method is more convenient for users, as it removes the obligation to retain multiple sets of credentials and creates a more seamless experience during operative sessions.

Organizations can accomplish this by identifying a central domain (most ideally, an IAM system) and then creating secure SSO links between resources. This process allows domain-monitored user authentication and, with single sign-off, can ensure that when valid users end their session, they successfully log out of all linked resources and applications. 

Multi-Factor Authentication (MFA)

Multi-factor authentication is a high-assurance method, as it uses more system-irrelevant factors to legitimize users. Like 2FA, MFA uses factors like biometrics, device-based confirmation, additional passwords, and even location or behavior-based information (e.g., keystroke pattern or typing speed) to confirm user identity. However, the difference is that while 2FA always utilizes only two factors, MFA could use two or three, with the ability to vary between sessions, adding an elusive element for invalid users.

What are the most common authentication protocols? 

Authentication protocols are the designated rules for interaction and verification that endpoints (laptops, desktops, phones, servers, etc.) or systems use to communicate. For as many different applications that users need access to, there are just as many standards and protocols. Selecting the right authentication protocol for your organization is essential for ensuring secure operations and use compatibility. Here are a few of the most commonly used authentication protocols.

Password Authentication Protocol (PAP)

While common, PAP is the least secure protocol for validating users, due mostly to its lack of encryption. It is essentially a routine log in process that requires a username and password combination to access a given system, which validates the provided credentials. It’s now most often used as a last option when communicating between a server and desktop or remote device.

Challenge Handshake Authentication Protocol (CHAP)

CHAP is an identity verification protocol that verifies a user to a given network with a higher standard of encryption using a three-way exchange of a “secret.” First, the local router sends a “challenge” to the remote host, which then sends a response with an MD5 hash function. The router matches against its expected response (hash value), and depending on whether the router determines a match, it establishes an authenticated connection—the “handshake”—or denies access. It is inherently more secure than PAP, as the router can send a challenge at any point during a session, and PAP only operates on the initial authentication approval.

Extensible Authentication Protocol (EAP)

This protocol supports many types of authentication, from one-time passwords to smart cards. When used for wireless communications, EAP is the highest level of security as it allows a given access point and remote device to perform mutual authentication with built-in encryption. It connects users to the access point that requests credentials, confirms identity via an authentication server, and then makes another request for an additional form of user identification to again confirm via the server—completing the process with all messages transmitted, encrypted.

See how SailPoint integrates with the right authentication providers.