Benefits of Multi-Factor Authentication in Electronic Marketplaces

Security Is a Challenge for Electronic Marketplaces

A lot of challenges for enterprise eCommerce and in particular, eCommerce marketplaces, or electronic marketplaces, is with data security and access security. One of the biggest ways that external breaches occur is through phishing, or through tricking users into giving their passwords or other sensitive information.

One of the biggest weaknesses that systems have had over the last decade has been the users not operating in a secure manner or getting tricked into giving access to their account. Phishing, using insecure login credentials, or other forms of hacking that take advantage of social weaknesses has become the most prevalent and effective form of hacking that goes on nowadays. This includes administrative access to systems.

Multi-factor authentication has been key to significantly resolve this for users. Most hacking attempts usually either try to brute force their way into accounts, such as by guessing weak passwords, or try to get people to give them information through phising. Multi-factor authentication, however, means you can't just put in a password and username to get access; you also have to have a second or third method, such as putting in a code the account owner received in a text on their phone, or putting in a fingerprint.

How Does MFA (Multi-Factor Authentication) Help?

Multi-factor authentication looks at, as the name implies, multiple factors to authenticate a user. One of the most common ways to enable convenience while enforcing multiple-factor authentication is to have a certain fingerprint for an authenticated device that’s logging in. The fingerprint, or device’s identification as an authorized device, is typically identified by its IP address and machine characteristics (e.g., the browser, browser version, machine operating system, the user’s Geo IP, and other information).

This composite fingerprint of the device is created so that if the device is not recognized for a user, then we give them multiple factors to authenticate their login. Username and password are a good starting place, but then they’ll be required to click a link or get an ID from their email or phone. They may also need to answer security questions or use a 30-second rolling key value that they have to provide. The user could also take a voice call and input data from the voice call. They can select a picture, color, a series of phrases that they have to enter, etc. There are many ways to require users to complete multi-factor authentication.

MFA Best Practices

With electronic marketplaces that have online platforms, it is imperative that vendors have their data secure, and their accounts don’t get modified because they’re using insecure logins. We also don’t want their email taken over because of phishing. Therefore, if a user is attempting to log in from an unrecognized device, then they would need to go through additional steps to authenticate their account—not just their username and password, but also additional steps.

We can set this as a default no matter what; it doesn’t have to be only if their device is not recognized based on this fingerprint model. But this is somewhat inconvenient for users to have multi-factor authentication every single login, so we can allow them to select a timeout period, such as a 30, 60, or 90-day period during which they don’t have to login with multifactor authentication. The user can also agree to a waiver that says they understand this increases the risk of a security breach, but for convenience they prefer to do it this way. In addition, we can give users options for how they do multifactor authentication, such as having simpler steps, but more of them.

The main takeaway with multifactor authentication is that just by turning it on it reduces the security risk exponentially. So by orders of magnitude it's reducing the risk of a breach from the most common method of breaching an account, which stems from users not putting in secure passwords. Even if there’s a minimum security requirement, people often use the same or similar passwords in multiple accounts and systems. So if there’s a breach in one system, it can be shared in the dark web, purchased, and then brute force can be used to attempt to log in on all the other sites that the user may be a part of. This is another common hacking method, so a user who has the same password on all these other sites is making themselves vulnerable.

With multi-factor authentication, however, this hacking attempt won’t work because we’ll be able to detect that it’s from a different device than the original user was authenticated with, which would cause the account to need multiple steps to authenticate the person trying to log in. This is an extremely effective method for nullifying hacking attempts.

Secure Important Data for Your Electronic Marketplace

Multifactor authentication is often utilized for administrator accounts or those with certain roles or assignments that have significant rights within the system. These present larger security risks data-wise for the business if they were to be hacked. Multifactor authentication is really key to preventing standard breaching attempts from being successful.

Multifactor authentication truly should be a strong consideration, if not a requirement for any advanced access roles within your organization. If you think about eCommerce marketplace and what some of the administrative and vendor roles have access to, it can certainly make or break your business as to whether these accounts are secure. If some of those accounts are breached, it affects the experience of the thousands or millions of users interacting with your system. This external party or hacker could change a lot of data and really wreak havoc; so we strongly recommend for administrative roles, vendor roles, etc. to be more secure with multifactor authentication.

It’s also very common nowadays, though, to require all users to have multifactor authentication. In most cases, as long as folks have the ability to enable a Remember Me feature, that has a 30, 60, 90, or 180-day expiration, which gives a fingerprint of their device, then most end users prefer multifactor authentication as well. It is really nice to have that extra level of security. People can relax and know they don’t have to become a security expert—they just need to complete the additional steps of authentication, and that’ll keep their account much more secure.