Multi-factor authentication (MFA) is an effective and well-adopted method of preventing cyberattacks based on password theft. So, it’s not surprising that companies are increasingly utilising it when employees and other users access sensitive data.
Mobile authenticator apps are one of the most secure and commonly used forms of MFA and are popular regardless of the vendor (Microsoft, Okta, Ping, Google, etc.). These apps provide additional verification methods to users via their mobile device, providing convenient access.
However, during the deployment of MFA for our clients, a recurring question often arises: What happens if a user loses their phone?
If you’ve ever lost or replaced your phone, you may have experienced this challenge for yourself. In today’s article, we explore how a user who has lost their phone can securely access an application protected by MFA, including a specific use case utilising Ping Identity tools.
There is no single fix to the lost device problem, as is often the case with any new product deployment within an IT environment. Depending on security requirements and user experience, several different solutions could be explored:
Enrol a second factor
Our first recommendation would be to ensure the user enrols a second factor – usually a one-time password (OTP) by email, a hard token, or Fast IDentity Online 2 (FIDO2) – to preempt any possible device loss. This proactive measure gives the user more autonomy and avoids the need to contact the help desk.
There are drawbacks to this approach, however:
Temporarily bypass MFA
Another method that solutions like PingOne offer natively is allowing the user to bypass MFA for a certain period. Once the user has a new smartphone, they can unpair the lost device themselves, enrol the new one, and inform the help desk to reactivate MFA. Notably, in this method, MFA is disabled for all applications the user attempts to access.
Bypassing MFA prioritises user experience at the expense of access security. This method also requires work from the help desk – both in supporting users in the process and in tracking those who deactivate MFA and preventing them from bypassing it even after enrolling a new device.
Contact the help desk
Perhaps the most obvious and simplest method is having the user contact the help desk to get assistance with unpairing the lost device. This will allow the user to enrol their new device, if they have one available, at the next login.
Again here, the solution is dependent on the help desk. We must also consider the need to verify the identity of the person contacting support. What if a cybercriminal poses as an employee who has lost their MFA factor to enrol their own device maliciously? This situation becomes particularly concerning if the company's main authentication system is passwordless and therefore relies solely on MFA.
Recognising the drawbacks to each of these options, Ping Identity has introduced a new set of tools to automate the recovery process, enhance user experience, and guarantee high security.
The first tool is PingOne DaVinci, a solution that allows for the easy creation of authentication journeys using connectors with prebuilt functions. These connectors, placed sequentially and linked via a drag-and-drop system, allow for customised authentication journeys with little to no coding required.
This tool can be combined with PingOne Verify, a cloud service capability, which utilises facial recognition from an ID document or a live selfie. Here’s how they work together.
Let's consider a hypothetical scenario with the following conditions:
The DaVinci flow enables us to organise the recovery and reenrollment process in two main steps:
Let’s break down those steps in more detail:
While there are a variety of options for MFA recovery, most methods to date come with drawbacks. Together, PingOne DaVinci and PingOne Verify offer an all-around effective alternative solution.
From a business perspective, combining these tools streamlines operations and improves the user experience without compromising security. Specifically, it allows companies to relieve help desks, which are often overwhelmed by multiple requests for lost factors. It gives users more autonomy, enabling them to avoid interruptions and remain productive. And perhaps most importantly, it’s ideal from a security standpoint, as MFA requirements are maintained.
Are you interested in exploring MFA solutions for your organisation? Contact us today.