In the next installment of Sounds Good's Cyber Bytes, Tracy Ross and Dr. Michael Ramage, director of Murray State's Cyber Education and Research Center, discuss the importance of multi-factor authentication. Although a common form of this kind of authentication involves receiving a text or email to confirm your log-in attempt, Ramage explains why that isn't the most secure form of authentication.
"A couple of weeks ago, the FBU raided what they call a SIM-swapping farm in New York," Ramage says. "I would dare say that every state has a SIM-swapping farm of some sort. In your phone, there is a SIM card, and that SIM card has that unique identifier for your phone, so that when I make a phone call to your phone number, it's going to ultimately connect my phone number with your SIM number, and it's going to connect to your phone. If I had a SIM that matched your phone, then I could trick something into thinking that I am you and text them a message. If I steal your username and password, and then I have a cloned SIM card of yours, then I can fake that second factor, actually show that I'm you when, indeed, I'm not."
Ramage says that to avoid potential security threats, there are four main forms of multi-factor authentication. The most secure option is a security key that physically plugs into the side of your computer. Another option is to have an authentication app, which often requires users to match numbers on their computer and phone screens in order to pass the authentication process. A text message authentication is better than none at all, Ramage says, but it's best to use a different method whenever possible.
"We're talking about it in October because right around the corner is November and December," Ramage says. "A lot of people are getting scammed because we're starting to get into the holiday spirit, we're getting festive, we're trusting people. All of a sudden, the bad guys are using that against us."
To read more "Cyber Bytes" stories, click here. To find out more information about Murray State's Cyber Education and Research Center, visit its website.
