An OT security practitioner wants to implement two-factor authentication (2FA). Which of the following is the least secure method to use for…

Two-factor authentication (2FA) over Short Message Service (SMS) is considered the least secure method among the options. It relies on the security of the telecommunications network, which is vulnerable to well-documented attacks. Adversaries can exploit weaknesses in the Signaling System 7 (SS7) protocol to intercept messages or use social engineering tactics for SIM swapping to take control of a user's phone number. Once the number is compromised, the attacker receives the 2FA codes, completely bypassing this security layer. The other methods listed do not share these specific vulnerabilities as they do not depend on the public telephone network for code delivery.

A. Out-of-band authentication (OOBA): This is a general category, not a specific method. While SMS is a weak form of OOBA, other stronger forms like push notifications to a dedicated app exist.

C. Authenticator Apps for smartphones: These apps generate Time-based One-Time Passwords (TOTP) locally on the device, which is significantly more secure as it is not susceptible to carrier network interception.

D. Fast Identity Online (FIDO) Universal 2nd Factor (U2F) USB key: This hardware-based method uses public-key cryptography and is the most secure option, providing strong protection against phishing, session hijacking, and man-in-the-middle attacks.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication (SP) 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management.

Section 5.1.3.2

"Out-of-Band Devices": This section details the risks associated with using the Public Switched Telephone Network (PSTN) for authentication

stating

"Use of the PSTN for out-of-band verification is RESTRICTED... OOB using SMS is deprecated

and may no longer be allowed in future releases of this guidance." This directly identifies SMS as a weak and deprecated method due to security concerns.

2. FIDO Alliance. (2020). White Paper: The FIDO U2F and FIDO2 Difference.

Page 2

"The Problem with Passwords and One-Time Passcodes (OTPs)": The document explains that while better than passwords alone

OTPs delivered via SMS are "susceptible to man-in-the-middle (MitM) attacks." It contrasts this with the superior security of FIDO standards

which are designed to defeat such attacks.

3. Ometov

A.

et al. (2018). A Survey on Security in Authentication and Key Management for Consumer Internet of Things. IEEE Access

6

49036-49063.

DOI: https://doi.org/10.1109/ACCESS.2018.2868168

Section IV-B

"Two-Factor Authentication": This peer-reviewed article discusses various 2FA methods

noting that SMS-based systems are vulnerable to attacks on the mobile network infrastructure

reinforcing its status as a less secure option compared to application-based or hardware token solutions.