Businesses need to provide users with secure access to disparate IT resources, such as cloud-based applications, on-premises workstations, and more. Relying on passwords alone to verify users is an information security disaster waiting to happen. One type of solution to provide secure access to data and resources is to use authentication tokens. Read on to get the lowdown on token-based authentication.
What is Token-Based Authentication?
Token-based authentication requires users to present a token in order to access a network resource. This token is often a computer-generated PIN or some sort of unique code. If you’ve ever needed to enter a one-time password sent to your mobile phone in order to access an app, you’ve used a type of token-based authentication.
You can break token-based authentication down into five simple steps as follows:
- The user initiates a request to access a network resource typically by logging in with a password.
- The client device or application verifies that the user has access to the resource and that the password is correct.
- Before granting access for a specific period of time, verification is requested by the resource server in the form of a token.
- A separate server verifies the correct password and issues a unique token to the user’s token authentication device.
- The token is validated by the desired resource server, and the user gets access for a specified time period.
The time period for a token’s validity can either be until the user logs out or a specific amount of time set by IT network administrators.
The Dangers of Password Reliance
The statistics paint a grim picture when it comes to relying on password-based authentication alone. A 2021 Verizon report found that 85 percent of the data compromised as a result of phishing campaigns is some sort of user password information. The same report found that when threat actors hack into systems, the methods most often deployed are using stolen passwords and brute force attacks.
The dependence on passwords alone is such a strong security risk that Joe Biden released an executive order (EO) in May 2021 mandating the use of multi-factor authentication at all federal agencies. According to a Thales article on the topic, the impetus for this EO arose from “several recent cybersecurity catastrophes, such as the ransomware attack targeting the Colonial Pipeline…and the SolarWinds hack that compromised nine federal agencies.”
Multi-Factor Authentication and Tokens
It’s important to note that token-based authentication is one type of authentication that can meet multi-factor authentication (MFA) requirements. MFA uses two or more distinct authentication factors to verify users and provide secure access to IT resources. These factors of verification fall into one of the following categories:
- Something users know, such as a username-password combination
- Something users possess, such as a unique security code sent to a mobile device or a physical USB token device
- Something inherent to a specific user, such as their fingerprint or face
Tokens fall into the second category of something users possess. Tokens can either require a physical connection to the system in order to grant access or they can be disconnected from the system. Here are two example scenarios for both of these token types:
- An employee comes to the office and tries to log in to their workstation. Before granting access, the employee needs to connect a USB fob.
- An employee remotely tries to access a corporate application. A server can communicate with the employee’s mobile device and send a one-time password to the device via text message. The employee enters the password in order to get access.
In both circumstances, an initial login attempt using a password initiates the request for a token before granting access. Tokens typically provide access for a certain amount of time that is decided by IT admin or security teams. But the time period can also be automatic depending on specific states.
Tokens provide an additional layer of security that protects against the risk of stolen credentials or brute force hacks. Even if an employee falls victim to clever social engineering techniques or uses a weak password, the employee’s credentials don’t result in automatic access to the network. Unless the hacker somehow obtains access to the token, then token-based authentication requests can stop password compromises in their tracks.
Token-Based Authentication Best Practices
As with many other business areas, successfully implementing token-based authentication depends on using a good strategy. This authentication strategy should specify and follow best practices, including:
Employee Awareness
An important part of your authentication strategy should be to inform employees about the importance of protecting their token device. Whether you’re using smartphone token-based authentication or a more traditional USB fob, employees should understand that privacy is paramount and that user token authentication devices shouldn’t be shared in any circumstance. This understanding can only be properly achieved with ongoing employee awareness.
Always Use Secure Connections
Communications between token devices and servers should use secure connections to avoid the risk of interception. This means always using HTTPS over other forms of connection because it uses encryption to protect data.
Monitor for Suspicious Behavior
Even if tokens improve information security, it’s prudent to monitor for suspicious behavior on the network or within specific applications. This behavior could be unusually high loads on logins or an unexpected change in the IP addresses using a resource. You should have in place remediation actions to stop potential attacks, such as destroying sessions, blocking specific IP addresses, or disabling certain user actions.
Conclusion
Today’s cybersecurity threat landscape sees organizations being constantly targeted with increasingly sophisticated attacks. Often, however, the initial entry point into a network stems from companies relying on just one form of authentication, such as a username and password combination. Token-based authentication provides a straightforward and scalable way to harden security against unauthorized access from malicious outsiders or insiders.
By Ronan Mahony
Ronan Mahony is a content writer focused on cybersecurity topics. He likes breaking down complex ideas and solutions into engaging blog posts and articles. He’s comfortable writing about other areas of B2B technology, including machine learning and data analytics.