How can you manage passwords and multifactor authentication in IAM?

1 Password policies

One of the first steps to manage passwords in IAM is to define and enforce password policies. Password policies are rules that specify how users should create and use passwords, such as length, complexity, expiration, and reuse. Password policies help ensure that users choose strong and unique passwords that are hard to guess or crack. You can use tools such as password managers, password generators, and password checkers to help users comply with password policies and avoid common pitfalls, such as using personal information, default passwords, or the same password for multiple accounts.

2 Password storage

Another important aspect of password management in IAM is password storage. Password storage is how you store and protect passwords in your systems, databases, or applications. Password storage should be done securely, using encryption, hashing, and salting techniques. Encryption is the process of transforming data into an unreadable form using a secret key. Hashing is the process of generating a fixed-length string from data using a mathematical function. Salting is the process of adding a random value to data before hashing it. These techniques prevent attackers from accessing or reversing passwords, even if they manage to breach your systems.

3 Multifactor authentication

Multifactor authentication (MFA) is a method of verifying users' identities by requiring more than one piece of evidence, such as something they know, something they have, or something they are. For example, you can use MFA to ask users to enter a password and a code sent to their phone, or to scan their fingerprint or face. MFA adds an extra layer of security to password-based authentication, as it reduces the risk of compromised passwords, phishing, or brute-force attacks. You can use various tools and protocols to implement MFA in your IAM, such as SMS, email, app, or hardware tokens, or biometric scanners.

4 MFA factors

When choosing MFA factors, you should consider the level of security, usability, and cost of each option. Some factors are more secure than others, depending on how easy they are to copy, steal, or spoof. For example, biometric factors are harder to replicate than SMS codes, but they may also have higher error rates or privacy issues. Some factors are more convenient than others, depending on how easy they are to access, use, or remember. For example, app tokens are more user-friendly than hardware tokens, but they may also require internet connection or battery power. Some factors are more expensive than others, depending on how much they cost to acquire, maintain, or replace. For example, hardware tokens are more costly than email codes, but they may also last longer or work offline.

5 MFA policies

The final step to manage MFA in IAM is to define and apply MFA policies. MFA policies are rules that specify when, where, and how users should use MFA, such as frequency, location, and device. MFA policies help balance security and usability, as they allow you to adjust the level of authentication according to the level of risk. You can use tools such as conditional access, risk-based authentication, or adaptive authentication to create and enforce MFA policies based on various factors, such as user role, data sensitivity, network type, or behavior pattern.

6 IAM best practices

Managing passwords and MFA in IAM effectively requires following some best practices. It is important to educate users about the importance and benefits of passwords and MFA, and how to use them properly. You should also monitor and audit your password and MFA activities, as well as review and update your password and MFA policies and tools regularly. Additionally, testing and evaluating your password and MFA performance, as well as user satisfaction, can help you identify areas for improvement.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?