It is fair to say, I like keeping busy. One way I do this is through working as a part-time research assistant at my University. The focus of the research is on context aware multifactor authentication (MFA), which is to say, how can we determine users are who they claim to be, using the context their phone and actions provide. This could be looking at their phone specs or typing speed to see if anything changes between each authentication or simply randomizing what form of authentication they use.

But eroz-codes, doesn't that seem like overkill? Well, maybe. The end goal is that this would be implemented in the industrial control systems (ICS) that support a countries critical infrastructure and, in the scope of my research, specifically the energy sector. There is a potential that if a malicious actor were to gain access to an ICS they could do a good deal of permanent damage to said country. This damage could range from small outages across to a full power grid being shutdown. So no, with that in mind, I think context aware MFA has a lot of potential to add a much needed layer of security.

My team is achieving this goal by creating an app that simulates the authentication process. We are seeing how much information we can gain from the user without them having to jump through unnecessary hoops. There is a saying that the challenge in cybersecurity is striking the balance between security and usability. You can have the most secure system in the world, but if it's too difficult for users to navigate, they'll find ways to work around it, compromising security in the process. Hopefully, this will maintain that balance without causing a need for users to find a loop hole.