The National Institute of Standards and Technology's (NIST) National Cybersecurity Center of Excellence (NCCoE) has published a guide to help online retailers implement multi-factor protections to reduce fraudulent purchases.
The effort arrives as technology companies call on MSPs to embrace two-factor and multi-factor authentication (2FA & MFA) to safeguard internal systems and customer systems.
The NCCoE is a public and private partnership working on cybersecurity solutions for specific industries. The 166-page document, entitled Multifactor Authentication for E-Commerce, is intended as a primer to show online retailers that it is possible to implement open standards-based technologies to enable Universal Second Factor (U2F) authentication.
“As retailers in the United States have adopted chip-and-signature and chip-and-PIN (personal identification number) point-of-sale security measures, there have been increases in fraudulent online card-not-present electronic commerce transactions,” the document’s authors (there are six) wrote.
MFA Security Explained
According to the NCCoE report, multi-factor authentication (MFA) is a “security enhancement that allows a user to present several pieces of evidence when logging into an account.” The “evidence” is derived from three sources: something you know, such as a password; something you have, such as a smart card; or, something you are, such as a fingerprint. To enhance security, evidence from two categories must be present, the association said.
To test various methods to deploy MFA, the NCCoE built a laboratory environment to explore ways for online retail environments for the consumer and the e-commerce platform to deploy upgraded identity access. The examples are meant to urge retailers to adopt MFA by using standard, commercially available components and open-source applications. THE NCCoE made it clear that it is not endorsing any particular MFA products.
MFA Security Benefits
Here are the MFA benefits for online retailers, according to the NCCoE:
- Help your organization reduce online fraudulent purchases, including those resulting from the use of credential stuffing to take over accounts.
- Show customers that the organization is committed to its security.
- Protect your e-commerce systems.
- Provide greater situational awareness.
- Avoid system-administrator-account takeover through phishing.
- Implement the example solutions by using the step-by-step guide.
