What is a user authentication policy?

How Authentication Works

A user authentication policy defines how an organization verifies that someone attempting to access services, applications, data, or networks is who they claim to be. It sets the rules for approved authentication methods, password or passphrase expectations, multi-factor authentication (MFA) or two-factor authentication (2FA) requirements, session timeouts, account lockout, and privileged access. Organizations use these policies to make sure the right users can reach the right resources and that sensitive systems are not protected by passwords alone.

A user authentication policy typically covers:

Password or passphrase requirements, including length, complexity, reuse limits, and secure reset processes. MFA or 2FA requirements for remote access, privileged users, sensitive applications, and risky sign-ins. Session management, including idle timeouts, maximum session length, and step-up authentication. Account lockout and recovery, including thresholds for failed attempts, rate limiting, and approved recovery workflows. Privileged access protections, such as separate administrator accounts, mandatory MFA, approval workflows, logging, and periodic review.

For authoritative guidance, the National Institute of Standards and Technology (NIST) publishes SP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator Management, which addresses authenticator types, authentication assurance levels, session management, phishing-resistant authentication, and authenticator management. A strong user authentication policy connects that guidance to everyday access decisions, including when to require multi-factor authentication, when two-factor authentication is sufficient, how authentication supports identity and access management controls, and how single sign-on sessions should be protected after sign-in.

What are the different authentication protocols?

Network authentication protocols are used to help securely transfer identity credentials for authentication between the subject (user or device) and the authentication server. There are several different authentication protocols for network access control, including:

• Kerberos
• Extensible Authentication Protocol (EAP)
• IEEE 802.1X
• Remote Authentication Dial-In User Service (RADIUS)
• Terminal Access Controller Access-Control System (TACACS)

Learn more about authentication protocol technologies.

How do I benefit from a user authentication policy?

A user authentication policy may be used to help ensure that only the intended audience is accessing certain assets in your organization. User authentication policies strive to ensure that the person requesting sensitive information and data is the right person to access that information.

Types of user authentication

Two-factor authentication (2FA)

Two-factor authentication, a subset of multi-factor authentication (MFA), is a two-step authentication process. It combines a username and password, or PIN, with a physical or mobile token for extra security. This combination of authentication factors makes it more difficult for a potential intruder to gain access. Cisco Duo provides two-factor authentication via the Duo Mobile app.

Three-factor authentication (3FA)

Three-factor authentication combines what you know, what you have, and what you are. Similar to a two-factor authentication, what you know and what you have typically involves usernames and passwords and a one-time token. However, with 3FA there is an additional factor--what you are--which uses biometrics such as fingerprints to verify a user’s identity.

Four-factor authentication (4FA)

Four-factor identification is another form of layered security that involves knowledge, possession, inherence, and location. As with 3FA, knowledge, possession, and inherence consist of passwords and PINs, token authentication, and biometrics. For an extra layer of security, 4FA also uses verification of a user’s login to authenticate the user.