If we need to choose a vendor for the 2FA in our environment, what are the features that we should look for?
Our selection process depends on the functionality and usability they provide. But when I went deeper, I got confused!

So, when you want to choose a 2FA vendor, What should we look for, and why? given the following constraints:

  1. Authentication methods [products]
  2. Token [Types, license, battery life and way to renew it]
  3. Supported environments [Windows, Linux...]
  4. Supported VMs [Hyper-V, VMware, Xen ..]
  5. Out-of-Band delivery [SMS, Email , phone call]
  6. Flexibility and Usability

What else?

  • Gartner produces a Magic Quadrant for User Authentication, which may be what you're looking for on #2, but it requires a paid subscription. – Tara Hodges Jul 22 '15 at 2:03
  • You can see our Guide to Evaluating 2FA systems reg free on this page: wikidsystems.com/learn-more/white-papers. But note: 1. It is a bit old and needs an update. 2. We are a vendor, so 'consider the source'. – nowen Jul 22 '15 at 2:29
  • You might want to get an independent consultant who is evaluating your requirements. There are several solutions out there with different focuses. Only from comparing features it is not easy to tell. Usually I do such consulting. It gets interesting, if you also need x509 certificates. But if you looking for a flexible and open source solution with enterprise support you might as well take a look at my project privacyIDEA. – cornelinux Jul 22 '15 at 12:11
  • thanks to all, [cornelinux] you are right. comparing features it is not easy. I tried to look at leading vendors in 2FA. but I can't make difference between them regarding to features. They look the same with different types. – AZ ELE Jul 22 '15 at 15:47

This is what I considered when determining what type of 2FA to use. Once I determined the solution type then I needed to identify which vendors were leaders in that space. I have the scoring document and all that if you want:

EVALUATION CRITERIASecurity/Compliance – Must be a secure solution that meets security standards as well as those of our clients, notably financial institutions, and regulatory agencies including the European Union. ➢ Ease Of Use For The End User – This category evaluates the ease of use for the end user including what they have to remember, carry with them, and whether or not the solution is intuitive. ➢ Day-To-Day Administration – How much effort is there to administer the solution on a day-to-day basis? This could be issuing the tool to the end users, replacing lost hardware, fixing bugs, terminating users, and all the other tasks to manage the. ➢ Implementation Effort – How much effort in terms of admin staff time, user training, hardware/software installation, configuration settings is required? ➢ Expedient Alternatives If Lost/Broken/Forgotten – If the tool fails, is lost or broken, what are the alternatives. Are the alternatives integrated within the solution or does it require circumventing the security of the tool? How long will the end user be down waiting for the secure alternative? ➢ Durability – How long can the solution be expected to last before replacement or repair? ➢ Acceptance – How widely accepted is this solution? Will it be a hard sell to security savy clients or will it be considered an impressive security control? Will this tool be supported long term or is there a chance that it will eventually be overtaken by a more popular technology ➢ Cost – This is for the Total Cost of Ownership (TOC). Cost of implementation, support, replacements, updates, and services, directly related to the tool as well as hidden cost such as increased system requirements or extended time for end users to authenticate.

| improve this answer | |

Authentication methods

Are you only authenticating or also other stuff? You might also need smartcards. Are you sure you only need SMS or do you also need to choose from a vast variety of tokens?


You might want to choose a solution, which is not provided by a token vendor. The thing behind this is: You can keep the software system but easily mix and switch tokens (no vendor lock). In theory you could do this with all OATH tokens... But you know theory and real life.

Supported environment

Where to install the authentication system? The other question is, what are the applications or operating systems where you want to authenticate. Easy API? Credential Provider? PAM module?

Supported VMs

No solution should be restricted in this way, that it can not be virtualized!

Out of band delivery

You might think this is cute at the moment. But you may realize in a year, that it is total crap and unsecure. You may also need to extend the usage scenarios. So do not only look for out of band but also look for a system with maximum token support and extensibality.

Flexibility & Usability

API API API. Can it be easily automated. E.g. Can it be integrated into your existing customer portal? Do you get the Source Code? I.e. can you ask s.o. to enhance it more quickly than the vendor would respond to a feature request? Can you still use it, when the successful vendor is merged with a bigger shark and the old product is ceased end of life? Especially in the IT Security we saw this often during the last years!

| improve this answer | |
  • I think your comment about API is spot on. You can authenticate any remote access solution with RADIUS and run it through your directory, but APIs are needed for custom apps and CSR applications (like token management). Think about availability of any api packages and licensing. No dev will want to talk to a sales guy about getting code and you don't want to have to involve legal either. LGPL or a similar license is best. – nowen Jul 23 '15 at 11:58
  • Take a look at privacyidea, which is AGPL and has the API well documented. – cornelinux Jul 23 '15 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.