Did you know that there’s an online black market in which hackers and cybercriminals sell stolen accounts/passwords? With a motivated market of people trying to steal them, relying on passwords alone is a lousy way to protect access to your business applications. In today’s vulnerable business climate, two-factor authentication is a great way to reduce risks. Read this whitepaper to learn how.

1. WHITEPAPER
Two-Factor Authentication for
Cloud Applications

2. Whitepaper
Building the Business Case for Cloud SSO
2
Table of content
The Benefits of Two-factor Authentication 3
Choosing a Second Factor 3
Balancing Convenience and Security 4
Single Sign-On (SSO) and Two-factor Authentication 4
Always Have a ‘Plan B’ 5
Summary 5
About CloudEntr by Gemalto 6

3. Whitepaper
Building the Business Case for Cloud SSO
3
Two-Factor Authentication for Cloud Applications
Did you know that there’s an online black market in which hackers and cybercriminals sell
stolen accounts/passwords? Stealing and selling passwords can be profitable at scale. With a
motivated market of people trying to steal them, relying on passwords alone is a lousy way to
protect access to your business applications.
Once you implement single sign-on, password security is even more critical. If one of those
hackers gets access to the single sign-on credential, they can access everything within the SSO
portal. Unless, that is, you’ve added a second factor to the SSO login. In today’s vulnerable
business climate, two-factor authentication is a great way to reduce risks.
The Benefits of Two-Factor Authentication
There are many ways to steal a password:
> Phishing (tricking people into revealing passwords)
> Sharing accounts inappropriately (you know people do that)
> Keyloggers planted through malware or on public kiosks
> Intercepting passwords over insecure WiFi connections (Want a little data breach with your
coffee?)
With two-factor authentication, attackers can steal the password but they cannot get into the
account without the second factor. And if that second factor requires access to a physical
device, or is communicated over another communication stream, the attacker’s job is a
WHOLE lot harder.
Using two-factor application makes your cloud SSO much more secure from breach. It also
helps in compliance by demonstrating that you’re making a best effort to protect access to
sensitive data.
Choosing a Second Factor
The cost, expense and convenience of two-factor authentication all depends on which type of
additional factor you chose.
The established security practice is to have authentication factors from at least two of the
different “types” of factors – something you know, something you have, and something you
are.

4. Whitepaper
Building the Business Case for Cloud SSO
4
A hacker in China might guess, steal or purchase your password, but they need to be
physically near you to gain access to your badge or fingerprint impression. Conversely, if
someone steals a hardware token, it is useless without the knowledge factor (the password).
The table below lists common authentication technologies in each category.
Something you know Something you have Something you are
Password/PIN
Security questions
One-time password*
Hardware token
Smart card/ID badge
One-time password
generator*
Fingerprint biometrics
Iris scanning
The One-Time Password (OTP) can be a special case. It’s a pin or password generated at the
time of the connection – hence something you know. It has a very short life, so even if a
keylogger steals it, they cannot use it. But if you have the password generator in your
possession, it then becomes something you have, equivalent to a hardware token. Using a
smart phone to either receive or generate an OTP essentially turns a commodity smart phone
into a physical authentication device.
Balancing Convenience and Security
Security and convenience are always in opposition. The challenge in any multi-factor
authentication deployment is balancing the increase in security with the potential hassle of
providing the second factor. Be sure to consider the following:
> Your business security and risk profile – Are you dealing in state secrets or large dollar
transactions? How sensitive is the data? How high profile is your business?
> The login environment – Do people reconnect frequently, and how time-sensitive are
those logins? How diverse is the equipment people use?
> Deployment cost and effort – What’s it going to cost to get everyone running with a
second factor? Do you want to buy and provision hardware tokens? Do you need to get
contractors or temporary staff up and running quickly?
Biometric methods (based on physical characteristics of the person) are sensitive to
environmental factors. For example, you don’t want to use fingerprint biometrics in situations

5. Whitepaper
Building the Business Case for Cloud SSO
5
where people are wearing gloves. And you need the fingerprint readers at the point of login,
so it matters what devices people are using.
Hardware tokens and badges require people to have another device with them – and to
remember to keep that device with them.
Decisions about authentication often must be made on an application-by-application basis.
Some cloud applications support only a certain subset of strong authentication methods.
Single Sign-On (SSO) and Two-Factor Authentication
If you use Single Sign-On (SSO) for cloud applications, you should think pretty seriously about
using two-factor authentication. Because consolidating logins also consolidates your business
risk if someone compromises the SSO login.
The good news is that using SSO makes two-factor authentication more practical and less of a
hassle. If you put the second authentication factor on the SSO login, then people only have to
present the second factor once. All ‘downstream’ logins are automatically protected.
Always Have a ‘Plan B’
You know how people forget their passwords and have to reset them? The same kind of thing
can happen to other authentication factors:
> People lose their smart phones – or drop them in water
> Fingerprints can be obscured by bandages or gloves, or fingerprint readers can
malfunction
> ID badges or smart cards can be left at home or sent through the washing machine
Just as you need a “Forget your password?” link, you will need a streamlined and secure way
to give people access when the second factor is not available. You don't want to shut people
out of doing their work.
Summary
Does two-factor authentication increase security and reduce risk? Absolutely – and it’s even
more important if you are using single sign-on. Is it expensive, complex or difficult to deploy
or use? That depends on the approach you take.
There is no single ‘right’ choice for a second authentication factor. You’ll need to balance your
business needs with convenience and cost concerns. A growing number of authentication
technologies take advantage of smart phones – devices people already have and carry with

6. Whitepaper
Building the Business Case for Cloud SSO
6
them through the day. These approaches make two-factor authentication practical and viable
even for smaller businesses with remote and mobile employees accessing their cloud
applications.
About CloudEntr by Gemalto
CloudEntr by Gemalto gives businesses a simple and secure way to manage cloud application
access. Using CloudEntr, businesses regain control of their trust networks and cloud
applications, while offering users convenient one-click access for all web applications in a
single interface. CloudEntr reduces complexity while helping businesses operate anywhere,
anytime, and at the right scale. Gemalto’s security and authentication expertise is trusted by
many of the world’s largest financial institutions and governments.
For more whitepapers, videos or eBooks or to download a buyer’s guide to Cloud SSO, visit
www.cloudentr.com/latest-resources.