From KBA to MFA: Why knowledge-based authentication is out

The weaknesses of passwords are both obvious and abstract because of their ubiquitous use in current authentication. But neither end users nor IT staff fully embrace passwords. Password security depends on end users selecting unique and secure values that are hard to guess. To nudge them in a secure direction, many IT staff impose mitigations such as minimum length, complexity, lifetime, and reuse restrictions. However, some complexity and lifetime mitigations backfire and result in weaker passwords and increased reuse, which can lead to password compromises – the main cause for 86% of web application breaches.

Despite being a “memorized secret,” secure passwords are difficult for humans to memorize. On average, most U.S. users must manage credentials to 200 online accounts. It is inevitable that some of these passwords will be forgotten or lost, creating a resource drain on the services and IT staff responsible for resetting them.

When faced with impossible feats of memorization, many users fall victim to subpar coping behaviors. One such behavior is using personal information that could be publicly available. A 2019 poll found that nearly 59% of users included a name or birthday in their account password, and 33% used a pet’s name. Attackers can easily discover this information, so this coping behavior makes passwords weak and predictable.

Another risky behavior is reusing passwords across multiple sites. The 2022 SpyCloud “Annual Identity Exposure Report” noted a 64% password reuse rate among users for whom at least one password had been exposed in 2021. Password reuse is a serious threat vector, and cybercriminals can take advantage of this practice more easily when users recycle their passwords across accounts. Additionally, reusing passwords is akin to placing multiple eggs into a single basket. If a single site suffers a breach, attackers can gain access to the one site and every other site sharing credentials with it.

It is inherently easier for a computer to attempt millions of passwords per second than it is for a human being to memorize a single unique one. This imbalance continually becomes more striking as computers become more powerful. The result is a painful tradeoff between security and usability in which the minimum secure threshold rises ever higher in a race against attackers and password cracking.

That they can be stolen at all demonstrates how weak passwords are. Whether a password is stored in an encrypted form or in plaintext, breached password data can ultimately be used to abuse the privileges of an account. This weakness places a target on central identity stores, such as web application databases, where a successful structured query language injection attack could result in a massive breach. Passwords can also be stolen by exploiting human vulnerabilities through phishing attacks. The strength of a user’s password becomes irrelevant if they simply hand it over in response to the latest phishing technique.

Some solutions can help individual users and organizations manage passwords and promote more secure practices. Password vaulting and privileged access management (PAM) solutions enable users to securely store passwords in a central location behind a single, strong credential. Further, these solutions empower users to use much stronger passwords and even completely randomized values as they only need to memorize the single, strong credential. However, these solutions are imperfect, and the innate vulnerabilities of passwords can persist. The password data stored within the solutions can still be shared or breached to abuse privileges. Like a web application password database, these solutions represent a single point of security failure. Additionally, if a login does not support copy and paste or auto-login functionality, users are still tempted to create weak passwords to reduce typing.

Although knowledge-based authentication has sufficed from early computing to today, it is no longer sufficient to protect users and their numerous accounts. As cyberattacks accelerate, the balancing act of convenience and security will only worsen unless a new paradigm of authentication is widely employed. MFA remedies the weaknesses of KBA by providing resistance against phishing, insecure configuration, and credential theft. In the absence of MFA on a site, users will need to continue resorting to using random strings for passwords and answers to (so-called) security questions and storing that information in robust password vaults.

Organizations can take the following steps to implement MFA:

• Identify authentication requirements. Organizations should analyze the current state of their IT infrastructure, identify all current authentication methods, and document business and compliance requirements. This analysis should include reviewing “forgotten password” and other password reset mechanisms. This process helps ensure that a potential MFA solution considers all use cases and determines the scope of implementation.
• Identify MFA solutions. Organizations should devote time and resources to researching various MFA solutions. Factors like cost, compatibility with existing infrastructure, ease of implementation, and vendor reputation should be considered. Different MFA solutions provide different levels of protection and usability. The right solution will balance security needs and budgetary constraints.
• Perform a cost-benefit analysis. MFA implementation incurs direct expenses (like purchasing the solution) and indirect ones (like possible decrease in productivity during the transition period). When compared to the potential costs of a security breach, realizing the likely lower cost of an MFA solution can help stakeholders and leadership make the investment.
• Develop a rollout plan. To achieve better adoption of MFA among end users, organizations should plan a gradual phased rollout. A structured deployment reduces risk, minimizes downtime, and fosters a positive environment for user feedback. The rollout plan should be revised to address issues as they emerge, and any exceptions should be documented.
• Pilot the MFA solution. Before deploying any solution on a large scale, organizations should test it on a small scale to confirm it works as intended and to address potential issues. A trial run smoothens the final rollout and alerts the team to potential difficulties.
• Educate users. Along with the rollout plan, organizations should train employees about the benefits of MFA, how to use it, and best practices. An informed end user is crucial to the success of MFA. Their understanding and buy-in is needed to reinforce the security culture.
• Monitor and improve the MFA solution. Organizations should implement the multifactor authentication solution according to the rollout plan. After the MFA rollout, they should continually monitor its effectiveness though defined performance indicators, gather feedback from users, and make adjustments as necessary to improve usability. Any documented exceptions should be reviewed and renewed if needed on a regular basis.