The second proof of identity at login: a phone app or a small physical key fob that gives a one-time code.
Users enter a one-time code or approve a push from the FortiToken Mobile app, or use a hardware token. FortiToken 410 is a FIDO-capable hardware key. It works with FortiGate, FortiAuthenticator and FortiIdentity Cloud.
Control depends on knowing who’s really logging in. If an inmate gets a staff password, a second factor can stop it from being used.
- Stops a shared or stolen staff password from working alone.
- Hardware tokens work where phones aren’t allowed.
- Supports multi-factor rules for CJIS access.
A phishing attack on a Michigan jail
In 2017, a man used phishing emails and phone calls on Washtenaw County employees to get into the county network, then altered a jail record to try to win an inmate’s early release. Staff caught it, and the county’s losses were at least $235,488.
Source: U.S. Department of Justice
- Hardware tokens work without a phone.
- Push approvals for mobile staff.
- FIDO keys resist phishing.
- Central assignment and revocation.
| Control | Priority | How this helps |
|---|---|---|
| IA-2Identification and Authentication (Organizational Users) | P1 | Provides the second factor for MFA. |
| IA-5Authenticator Management | P1 | Supports authenticator lifecycle management. |
Plan for lost tokens and for shift change.
Based on CJIS Security Policy v6.1. This product can support these controls but can’t satisfy them alone. How to read this table