What is Two-factor Authentication? It’s a security measure that requires a user to verify their identity using two different methods. In doing this, there is an extra layer of security compared to just accessing an account with a username and password. You’ll sometimes see this described as “using something you know” like a username and password, with “something you have” like a token or code. You’ll typically see Two-factor Authentication abbreviated as 2FA.
2FA significantly reduces the risk of unauthorized access, even if someone has stolen a password. Websites and service providers are increasingly using 2FA to protect users’ credentials from being used by hackers, who have stolen a password database or used phishing attacks, to obtain user passwords. 2FA requires a possession factor or an inherence factor to be used along with the knowledge factor (username and password).
Possession Factors can include an ID card, a security token, a mobile phone, a mobile device or a smartphone app, to approve authentication requests.
Inherence factors, also referred to as biometric factors, is something inherent in the user’s physical self, such as fingerprints or facial characteristics, to approve authentication requests.
Options For Two Factor Authentication
In addition to the primary Authentication options of Active Directory and Local Logins, Passwordstate supports multiple authentication options that can be used in 2FA approaches,
The above list can be found on our website under Authentication Options on the Products menu. The majority of these authentication options are possession factors and are used with your knowledge factor, either Active Directory user account and password, or local login account and password.
Authentication Options: Where Are They Set?
The Authentication Options in Passwordstate are set in a number of areas. Globally, you can set the base Authentication, including your chosen 2FA in System Settings. This will apply to all accounts accessing Passwordstate. This is the recommend approach that will cater for the majority of users.
Or, you can allow individuals to set their own authentication options under their user Preferences (you can also hide this option).
Or, you can mandate what authentication options are required based on Security Group Membership. This is extremely useful when also being used with Single Sign-on (SSO) and you need to cater for individuals that operate within a highly privileged account set.
With all of these options, Click Studios Best Practice for Passwordstate Authentication is to cater for the majority via global settings and fine tune for major alternatives via User Account Policies. Setting Authentication options under preferences should normally be used for high value/impact individuals (read Business Executives).
Authentication Options: How Are They Set?
For people new to managing Passwordstate, the simplest Authentication Option to set is the global setting (also referred to as the System Wide Setting). To do this navigate to Administration->Systems Settings->authentication options, and under Web Authentication Options select your preferred 2FA from the drop down list labelled Choose Authentication Option
Remember to select an option that uses the 2 factors, for example Manual Login and Google Authenticator. If you want to disable the ability for individuals to set their own authentication options you can set the options to be excluded under Hide the following Authentication Options on User’s Preferences screen,
The next option is under User Account Policies. This should be the go to area for exceptions to global authentication settings,
Under Administration->User Account Policies you can define specific options for how Passwordstate looks and behaves, including the type of Authentication Option to use. The options available from the drop down list are identical to those present under system settings, with an additional option of Use the System Wide Authentication Settings.
Once you have specified all the options for your chosen PolicyName you’ll need to apply the policy to a user or users. It is highly recommended that you use Security Groups to define who your policy is applied to.
In the example above, Passwordstate is using AD Single Sign-on as the global setting and specifying that all Security Administrators instead must use Manual Login and Google Authenticator as their authentication option.
Lastly, if you have decided to provide it, is the ability for users to set their own preference for authentication options. This is managed on a per user basis under Preferences->Preferences->authentication options->Web Authentication Options. Once again, the options available from the drop down list are identical to those present under system settings and include the Use the System Wide Authentication Settings.
Additional Options
Passwordstate has additional options for 2FA. These include providing the option for accessing Passwordstate outside of your normal IP address ranges, when accessing a Password List containing highly confidential credentials and providing an additional level of security when using the Emergency Access account.
The first is found under Administration->System Settings->allowed ip ranges. Here you can set additional Authentication Options for when users try to access Passwordstate outside of the list of Web Site Allowed IP Ranges (image below),
This is useful for authenticating users that work remotely, such as on-call Administrators, when they need to access Passwordstate from anywhere outside the corporate network.
Next is for highly confidential Password Records. You can specify at the Password List level, that users must first authenticate using the specified Additional Authentication, before accessing any of the Password Records within that Password List,
This adds an additional layer of security when accessing those highly confidential or sensitive Password Records.
Lastly, you can enable 2FA on your Emergency Access Account. This is a highly recommended best practice for Passwordstate.
In summary, 2FA significantly reduces the risk of unauthorized access, and Passwordstate provides multiple authentication options for organizations to choose from.
From access to Passwordstate, access to highly confidential password records, access based on security group membership and the IP address range a login is originating from, our 2FA options have got you covered.