@Caute_cautim asked if SMS across the telco infrastructure (Signal System 7/SS7) as the second factor in two-factor authentication (2FA) provides sufficient protection for system login. As asked, the question cannot be answered for two key reasons. First, the word sufficient is a subjective term, providing no basis for measurable evaluation of whether any tool or process is sufficient. Second, the question can only be answered when asked in a clearly defined context. Sufficiency can be judged only when we have clearly defined measurable criteria plus the environmental context.
To illustrate the argument, consider physical security provided by a door with installed lock. We define several levels of measurable resistance to intrusion through that locked door based on the type of attempt to get in.
Here is a suggested hierarchy of attempt types:
1. Simply turning the handle to see if it is locked.
2. Using a card or shim to push back the latch of the locked handset.
3. Time required for an experienced knowledgeable lock-picker to pick the lock.
4. Breaking the lock with brute force, such as a hammer.
5. Breaking a hole in the door, allowing the intrucer to reach through the hole and unlock or open the door from the inside.
6. Breaking the entire door open enough to walk in without dealing with the lock.
For environmental context, consider where the locked door is, what it is protecting, and who is trying to enter.
Where:
1. Bedroom in a private single family home.
2. Front door of an apartment in a controlled access apartment building.
3. External door of a private home in publicly accessible residential neighborhood.
4. External door of a dry cleaning establishment.
5. External door of a jewelry store.
6. External door of a Google or Amazon or IBM cloud service provider (CSP) facility.
I7. nternal door to the server farm room at a CSP facility.
The door is protecting the following:
1. Personal privacy in the bedroom.
2. Valuable items in storage, e.g. cash, jewelry, artwork, firearms, etc.
3. Sensitive information.
4. Legally protected information.
Who is trying to enter?
1. Family child wanting water.
2. Family teen snooping for cash or parents' adult entertainment magazines and videos.
3. Burglar.
4. Identity thief.
5. Corporate spy.
6. Nation-state spy.
Define your measurable level of protection, where and what you are protecting, and who you are protecting against (implied motivation) and you will finally be able to determine what is sufficient. You have so many options: The door can be hollow core, solid core with windows, solid core without windows, or steel. The lock can be internal latch opened with nail or screwdriver, simple latch with lockset, deadbolt, double-throw deadbolt, lock-pick resistant with custom key, etc.
Other analogous discussions can use the standards for safes resisting entry attempts, and for fire-resistant storage boxes.
@Shannon hinted at some of these issues in the previous reply.
