When security professionals compare notes, one of the first questions they ask each other is whether or not they have one-, two-, or three-factor security. If Priva-Tech can convince the world that a fourth factor exists, the security conversation could be changing.
Single-factor security, widely regarded as the weakest form of security, is based only on what you know. This could be a user id, a password, or a combination of the two. Much stronger is two-factor security; usually a combination of what you know and something you have. The ATM card that you have combined with the PIN number that you know is the most common implementation of two-factor security.
The third factor, and one which has recently been getting a lot of attention, is who you are; it is always, via biometrics, verified by a body part unique to you -- your fingerprint, your eyes or your face.
According to Gartner security analyst John Pescatore, "Because of the cost, you rarely if ever (even in the most sensitive situations) see all three factors deployed simultaneously. Biometrics is usually used to replace the 'what you know' part because it's so weak. Even for the most secure installations, doubling up with two factors -- who you are and what you have -- is plenty. But even that is expensive.
"For example, banks want to get away from PIN numbers because people forget them. They could do something that is a combination of an ATM card and a fingerprint reader, perhaps with the fingerprint reader right on the card. But banks have been slow to move to a better system because the cost is so horrendous."
If doubling up with two of the three factors is enough (and still cost-prohibitive for many), does it make sense to have a fourth factor?
Priva-Tech's Jeff Minushkin thinks so. The company, which he says has been in stealth mode for several years and servicing government-based clients, is ready to reach out to corporations with what he says is a fourth factor of security.
