Everything you need to know about Two-Factor Authentication and why using it for UC&C services
Today we use online services to shop, to collaborate, to meet new people and to keep in touch with friends. Many of these online services contain and store private information, such as user personal data, contact lists, credit card credentials, patient information etc.
However we all know that breaking into the system, in many cases, is just a question of time. Your password can be stolen or hacked every now and then.
Someone can pretend they are you and steal your identity.
In fact it has already happened to many of us at least once. What can we do to protect ourselves and our sensitive data?
Before starting to use a service, users have to first sign up and then to authenticate themselves to the system each time. Authentication procedure requires users to enter something they know to identify themselves, and that is their login and password. To increase the level of security, many services require user to make up a strong password, that is a password consisting of at least eight characters and containing at least one uppercase letter, one lowercase letter, one digit and one special character. Additionally, users are requested to regularly change their passwords. These steps definitely increase the level of security, but they might still not be enough…
What is Two-Factor Authentication (2FA) or Two Step Verification, and how does it work?
No system is perfect. However there is something that we can do about it, and that is–adding an additional layer of security.
Two-factor authentication is just an extra layer of security. In simple words, if you secure a door with a lock, it’s already something. If you secure it with two locks, it’s twice as efficient as securing it with one lock, since it will take more time and effort to a potential intruder to break it (and perhaps they will not even try).
This is why many websites and global online services have already added support for Two-Factor Authentication or Two Step Verification, among them Apple, Google, Microsoft Office, Yahoo, Paypal, Facebook.
How does it work? When 2FA is enabled, a user is required to verify his or her identity by providing two pieces of information:
- something they know (login and user password)
- something they have (a mobile device or an app installed on your device)
When it comes to login and user password, everything is clear. The second point–providing something that you have–can be realized in different ways. Some services require you to enter a verification code which is sent to your mobile number by SMS or which you can receive via a voice call. Others require you to enter a one-time code generated by an external app installed on your smartphone, for example, Google Authenticator or Windows Authenticator.
Why UC&C systems should add support for 2FA asap
Now let’s talk about UC&C and its security issues. Needless to say that a Unified Communications system which combines VoIP, video, chat, presence information, present unprecedented security challenges, with these systems being used by government, public administration, Universities, banks, hotels and hospitals.
One of the biggest security concerns of any organization that has implemented a VoIP system with Unified Communications is eavesdropping or secret intrusion–an idea of someone being able to monitor your calls. Another huge concern is someone being able to hack into your VoIP network, gaining control over the company’s lines and SIP trunks and making long distance calls at the company’s expense.
By adding support for 2FA, UC&C vendors provide their end customers with the possibility to add an extra layer of security and make their data and their communications twice as much protected as compared to a system which does not offer 2FA.
Let’s make it clear though, security in a UC&C system is not all about this, it goes far beyond user authentication issues. The best way to secure your business communication is choosing in the first place a UC&C solution which is secure by design, such as Wildix.
Read more about Security at Wildix
Weak Points and Risks in using 2FA
When it comes to codes sent via SMS or received by phone calls, it is necessary to mention that some users are not attentive to what exactly they are being asked to approve, which gives an easy way for an attacker’s transaction. For example, sometimes it happens that inattentive users accidentally approve a credit card transaction made by an attacker using 2FA. Phone companies can sometimes be a leak point as well.
Wildix has implemented 2FA support using an external application installed on a user’s device, which generates one-time codes, valid for a short period of time, decreasing in this way a risk where a potential malefactor could intercept an SMS or a phone call. However what happens if a user loses his or her smartphone? Yes, you are right, it means that this user temporarily loses access to his or her account. When it comes to a UC&C system, it’s sufficient to contact the system administrator who would reset the user password and 2FA settings. If you are using the Wildix system, it will take you just a few seconds. In any case, losing access to your account for a couple of minutes is less critical than granting an access to an intruder, don’t you agree?
To summarize, enabling Two-Factor Authentication can be as annoying as making up and memorizing strong passwords or regularly changing your user password. However in the same as we lock our cars and our homes, it is important to keep our digital life safe. Adding an extra layer of security thanks to 2FA helps keeping intruders out.
If you are a business owner who’s considering changing a telephone system in the nearest future, opt for the UC&C solution of Wildix which is secure by design and which offers Two-Factor Authentication.
Contact us for more information: