With an increasingly mobile workforce and ID and data theft soaring, companies are going to demand their staff employ two-factor authentication for network access. The preferred solution for almost 30 years has been the loyal physical token but, in my opinion, 2011 is going to be the year of its demise. Ninety-eight percent of my customers agree that using tokens is an outdated pain, and that using their own phones is definitely the preferred route as an access authentication tool.
So what evidence do I have to prove that the physical token will be dead by the end of the year? (And the RSA breach has just added to its demise.) Let’s examine the evidence.
◦ And the millennium brought with it the BluRay Disc.
For thirty years, little has changed with the physical token, as it still relies on out-dated technology.
◦ Right from the start, token deployment has proven time consuming. For 1000 tokens to be distributed, with many sent using a postal system to remote workers, it will take six months to complete.
◦ Third-party contractors will often find themselves carrying around a number of tokens for their various clients and having to work out which one is the right one for each system.
So the stark reality is that many organisations will make the decision that the security offered by two-factor authentication isn’t justified anymore, taking into the account the amount it costs to deploy them. So what else is there?
SMS Isn’t New, So What’s Changed?
In 2000 the number of mobile phones in use started to sharply increase. In fact, according to gsmworld.com, there are over 4,947,400,000 GSM and 3GSM connections globally, with the figure steadily increasing every second. By the time you reading this it wouldn’t surprise me if that figure had topped five billion.
Utilising SMS technology, any mobile phone can be used as an authentication token. A passcode is sent to a user’s device, eliminating the need for a physical token. Other enhancements include the option of re-using a user’s existing password instead of remembering a separate PIN. However, SMS technology alone isn’t the answer, as there have been instances when it has proved to be unreliable. In a small number of cases, estimated at 4%, SMS messages can take longer than one minute to get through. Other issues could be the network is temporarily suspended or the user may be in a signal dead spot, such as the basement of a building or computer room. It is this argument that has saved physical tokens in the past – but it can no longer stave off the Grim Reaper’s scythe.
With the advent of pre-loaded codes, mobile phones are able to hurdle this final barrier. As soon as a user enters their authentication code, the system automatically forwards a new SMS message, overwriting the code in an existing message ready for the next session.
It’s always going to be hard to justify writing off an investment. Yet that’s the sensible thing to do if you don’t want to continue haemorrhaging money supporting an old technology.
For starters, it is estimated that moving to SMS authentication will reduce ongoing running costs by 40–60%, and they only last for between three and five years. With an SMS system, the majority of users will already have a mobile phone. If for any reason a user does not have a mobile phone, a voice text can be sent instead to a number stored on the system.
There is the argument that people do misplace their mobile phones, but this is also true for physical tokens. It is people’s attachment to their mobile that is the differentiator, as research by YouGov on behalf of SecurEnvoy recently revealed that a third of 2000 people interviewed would notice they’d lost their mobile phone within 15 minutes, and 60% would within the hour. The lack of an emotional attachment to a physical token can mean its loss will not be discovered until the user actually needs to use it, which could be hours, or even days, later.
Other benefits of using automation: an SMS system can be set up in a day (an average of 300 users per minute) instead of six months. The existing employee database is used, with mobile numbers automatically identified. For records where a number is not listed, an email is automatically sent requesting the user to self enroll.
And, finally, tokenless two-factor authentication substantially reduces a company’s carbon footprint. It would require 1673 trees to offset the emissions created in deploying 3000 tokens.
Phones have, therefore, become multifaceted functional devices and fantastically inexpensive resources for employers to use as a security device that can keep their data secure using the latest and smartest SMS authentication technology. It’s my view that tokens have certainly had their day and will slowly disappear as the year goes on.