How multifactor authentication looks like in the DC?

Information protection is one of the condition of data center functioning. Therefore, it is necessary to assign different levels of access to users to protect information. Usually, several levels of protection are used, including authentication (identity verification), authorization (access control) and accounting of actions (logging). Access to any critical information or equipment should use multi-factor protection.

Three levels of protection - the gold standard of the data center

Most simple security systems use information that is known to a particular user category for protection. This is usually a password and login. In order to gain unauthorized access to resources or equipment, an attacker must obtain this data. Data centers do not have one, but several levels of protection.

The second level of protection usually uses something that belongs to the user

This is, for example, a one-time password generated by a token card, or the same password sent to the user's smartphone via SMS.
And, finally, the third level of protection is biometrics. The fingerprint, the picture of the iris, the analysis of the voice - all this is biometrics. Adding a third layer of protection significantly hinders the access of attackers to critical resources for the company.

Now there are two trends in the multifactor authentication

The infrastructure of data centers lost its geographic location. Employees of the company, including administrators and system engineers, are not in the same building. Moreover, employees of the same company may be in different regions of one country or even in different countries on different continents. In this case, setting the system of priorities, access levels and forming a multifactor authentication system is very important.
Multifactor authentication system is gradually evolving. Even social networks and other web services have begun implementing two-factor authentication, not to mention corporations services. Now one more trend is noticeable: the gradual abandonment of card tokens in favor of mobile applications or web services. Access passwords are sent via SMS to the user's phone, which eliminates the need for using tokens that may be lost.