2FA isdoes not just indicate only the use of a one-time key as(as in the use of a Token like RSA,) or an app Like(like Google, Authenticator) or even a text or phone call with a one time key.
2FA can be a combination of any 2 of the following: Something you have (Card, One Time Key, Token, Specific Cert or device) Something you are (Fingerprint, Retina..) Something thing you know (Password, key word..) Somewhere you are (Global Location, i.g. Office, State, Country..)
- Something you have (Card, One Time Key, Token, Specific Cert or device) = Something you are (Fingerprint, Retina..)
- Something thing you know (Password, key word..)
- Somewhere you are (Global Location, i.g. Office, State, Country..)
With each of these you would calculate risk e.g. someone can acquires your device, guess you password, intercept text message or phone call..
Depending on what you are trying to secure and the risk, you would determine what kindcombination of authentication to go with. You should weigh the Easeease of use for your users vs the security factor.
For instance, Something you are is more secure as it is harder to replicate (for the time being) but also the ease of use is slightly harder to implement especially for remote users.
There is even a such thing a 3FA or more.
As for 2FA keep in mind you are not always necessarily going to keep the bad guys out. You are just trying to make it that much harder so they need more sophistication to get in or move on to easier targets and not you.
2FA is only one step in helping secure your data. Monitor login attempts failures and successes, behavior monitoring and a whole lot more....
