Multifactor Authentication vocab

SFA (Single Factor Authentication)

using only one authentication method to verify identity

OTP (One-time password)

a temporary password valid for a single login session or transaction

TOTP (Time-based one-time password)

An OTP generated based on time synchronization between a server and device

Hash-based Message Authentication Code (HMAC)-based one-time password (HOTP)

An OTP generated using a counter-based algorithm

Token

a physical or digital object used to authenticate identity

Soft Token

digital authentication token usually generated by an app

Hard token

a physical device such as a key fob or USB security key

SMS authentication

receiving OTPS via text message (vulnerable to SIM swapping)

SIM swapping

a cyberattack where a criminal transfers a victim’s phone number to another SIM card to intercept SMS codes

SSO (Single sign-on)

a system that allows user to log in once and gain access to multiple resources without re-authenticating

MITM (Man-in-the-middle) attack

An attack where a hacker intercepts communication between two parties to steal authentication data

IAM (Identity and access management)

framework of policies and technologies to ensure the right users have the right access

FIDO2 (Fast Identity Online 2)

an open standard for strong authentication, passwordless authentication using hardware tokens

U2F (Universal 2nd Factor)

older authentication standard that provides strong second factor using physical security key and public-key cryptography

Adaptive Authentication (risk-based authentication)

Adjusting authentication requirements based on context, such as location or device risk

Phishing

deceptive attempt to steal sensitive data