Forrester outlines multi-factor authentication best practice

Business users often resist second-factor authentication methods

Forrester Research has released a new report outlining best practices for the rollout of multi-factor authentication (MFA) systems.

The analyst firm said that many companies in Europe and North America had rolled out MFA technologies to parts of the business where it is deemed critical, but had not embarked on a company-wide rollout.

The report suggested that this limited approach is down to a reluctance on the part of business users to accept the 'inconvenience' of second-factor authentication, such as having to carry an extra card or enter more numbers when signing on to systems.

IT departments also face a bewildering array of MFA systems on the market, from USB tokens to smartcards and biometrics, according to Forrester security analyst and report author Bill Nagel.

The report, entitled Implementing Strong Authentication in Your Enterprise, is based on interviews with vendor and user companies, and sets out how to implement a successful MFA strategy.

Usability should be the key factor when choosing a second-factor authentication method, and IT departments should run a pilot programme with typical users to get an idea of the problems users are likely to face.

Internal marketing is key, and Nagel advised IT departments run internet campaigns and group presentations.

The project should be pitched as a means to protect customer data rather than the company's information assets, as this will be more appealing to users, Nagel concluded.