Skip to main content
SpringerLink
Log in

An Effective Tool for Assessing the Composite Vulnerability of Multifactor Authentication Technologies

  • Conference paper
  • First Online:
Advances in Security, Networks, and Internet of Things

  • 1432 Accesses

Abstract

While multifactor authentication technologies continue to advance and adoption rates for those technologies increase, there exists a need to characterize the composite vulnerability score for complete authentication solutions. To meet this need, we propose an extension to the Common Vulnerability Scoring System (CVSS) v3 calculator to provide an aggregate score for any metric category, enabling organizations and researchers to succinctly determine the composite vulnerability impact of authentication factor multiplicity. This chapter has presented a novel mathematical approach and demonstrated the approach through a real-world application which is a comparative study on the composite vulnerability of two different multifactor authentication technologies.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 229.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 299.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 299.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

References

  1. D. Lipaj, V. Davidavičienė, Influence of information systems on business performance. Mokslas – Lietuvos Ateitis 5(1), 38–45 (2013). https://doi.org/10.3846/mla.2013.06

    Article  Google Scholar 

  2. L. Henderson, Multi-Factor Authentication Fingerprinting Device Using Biometrics (Villanova University, 2019)

    Google Scholar 

  3. A. Tang, Two-factor authentication: The death of the password? [Blog] (2020). Retrieved from https://www.itproportal.com/2015/01/15/two-factor-authentication-death-p4ssw0rd/

  4. T. Webb, An Architecture for Implementing Enterprise Multifactor Authentication with Open Source Tools (SANS Institute Reading Room, 2013)

    Google Scholar 

  5. Y. Choi, Security weakness of efficient and secure smart card-based password authentication scheme. Int. J. Appl. Eng. Res. 12(7), 1222–1226 (2017)

    Google Scholar 

  6. S. Carberry, DOD pushes toward CAC replacement. FCW (2017). Retrieved from https://fcw.com/articles/2017/08/14/dod-cac-replacement-carberry.aspx

  7. J. Couretas, M. Ucal, Organizational adoption of innovation: Background, programs & a descriptive modeling approach, in Military Modeling & Simulation Symposium, (Society for Computer Simulation International, Boston, MA, 2011), pp. 44–52

    Google Scholar 

  8. P. Mell, K. Scarfone, S. Romanosky, A complete guide to the common vulnerability scoring system version 2.0. CVSS (2007). Retrieved from https://www.first.org/cvss/v2/guide

  9. E. Kovacs, FIRST announces CVSS version 3.1 [Blog] (2019). Retrieved from https://www.securityweek.com/first-announces-cvss-version-31

  10. Common Vulnerability Scoring System v3.0: User Guide. Retrieved from https://www.first.org/cvss/v3.0/user-guide (Accessed May 25, 2021)

  11. Common Vulnerability Scoring System v3.0: Specification Document. Retrieved from https://www.first.org/cvss/specification-document (Accessed May 25, 2021)

  12. O. Santos, The evolution of scoring security vulnerabilities: The sequel (2016). Retrieved from https://blogs.cisco.com/security/cvssv3-study

  13. L. Allodi, S. Biagioni, B. Crispo, K. Labunets, F. Massacci, W. Santos, Estimating the assessment difficulty of CVSS environmental metrics: An experiment. Future Data Secur. Eng., 23–39 (2017). https://doi.org/10.1007/978-3-319-70004-5_2

  14. D. Nguyen, D. Nguyen-Duc, N. Huynh-Tuong, H. Pham, CVSS, in Proceedings of the Ninth International Symposium on Information and Communication Technology – SoICT 2018, (2018). https://doi.org/10.1145/3287921.3287968

    Chapter  Google Scholar 

  15. Latent Feature Vulnerability Ranking of CVSS Vectors, in Summer Computer Simulation Conference (SCSC) (2017). https://doi.org/10.22360/summersim.2017.scsc.019

  16. S. Hazari, Challenges of implementing public key infrastructure in Netcentric enterprises. Logist. Inf. Manag. 15(5/6), 385–392 (2002). https://doi.org/10.1108/09576050210447073

    Article  Google Scholar 

  17. National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations (National Institute of Standards and Technology, Gaithersburg, MD, 2017), pp. 6–17

    Google Scholar 

  18. I. Velásquez, A. Caro, A. Rodríguez, Authentication schemes and methods: A systematic literature review. Inf. Softw. Technol. 94, 30–37 (2018). https://doi.org/10.1016/j.infsof.2017.09.012

    Article  Google Scholar 

  19. D. Dasgupta, A. Roy, A. Nag, Toward the design of adaptive selection strategies for multi-factor authentication. Comput. Secur. 63, 85–116 (2016). https://doi.org/10.1016/j.cose.2016.09.004

    Article  Google Scholar 

  20. D. Stebila, P. Udupi, S. Chang, Multi-factor password-authenticated key exchange, in Eighth Australasian Conference on Information Security, (Australian Computer Society, Inc., Brisbane, Australia, 2010), pp. 56–66

    Google Scholar 

  21. NVD - CVE-2020-11052, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2020-11052

  22. NVD - CVE-2019-14833, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2019-14833

  23. NVD - CVE-2019-3980, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2019-3980

  24. NVD - CVE-2018-16393, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2018-1639

  25. NVD - CVE-2019-13603, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2019-13603

  26. NVD - CVE-2020-7958, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2020-7958

  27. NVD - CVE-2019-12813, (2020). Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2019-12813

Download references

Author information

Authors and Affiliations

  1. Colorado Technical University, Colorado Springs, CO, USA

    Adam English & Yanzhen Qu

Authors
  1. Adam English
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yanzhen Qu
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yanzhen Qu .

Editor information

Editors and Affiliations

  1. Electrical and Computer Engineering, and Computer Science, University of Detroit Mercy, Detroit, MI, USA

    Kevin Daimi

  2. Department of Computer Science, University of Georgia, Athens, GA, USA

    Hamid R. Arabnia

  3. School of Computing and Data Sciences, Wentworth Institute of Technology, Boston, MA, USA

    Leonidas Deligiannidis

  4. Computer Science and Information Engineering, Asian University, Taichung City, Taiwan

    Min-Shiang Hwang

  5. Facultad de Informática - CIC PBA, Universidad Nacional de La Plata, La Plata, Argentina

    Fernando G. Tinetti

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

English, A., Qu, Y. (2021). An Effective Tool for Assessing the Composite Vulnerability of Multifactor Authentication Technologies. In: Daimi, K., Arabnia, H.R., Deligiannidis, L., Hwang, MS., Tinetti, F.G. (eds) Advances in Security, Networks, and Internet of Things. Transactions on Computational Science and Computational Intelligence. Springer, Cham. https://doi.org/10.1007/978-3-030-71017-0_7

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-71017-0_7

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-71016-3

  • Online ISBN: 978-3-030-71017-0

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation