Two-factor authentication is often reffered to as strong authentication, its defined as two out of the following three items:
• Something you know, like a password
• Something you possessed, like a Token or your Mobile Phone
• Something unique, like a fingerprint
When information is particularly sensitive or vulnerable, using a password alone may not be enough protection and a stronger means of authentication is required that’s harder to compromise.
For example, health care information on a shared computer can be both sensitive and vulnerable. It’s sensitive because its exposure could result in HIPAA violations and fines, not to mention the loss of patients’ confidence in the medical institution. And the information is vulnerable if the shared computer can be used by many people or if it is connected to the Internet.
These are the kinds of situations that require two-factor authentication. While biometrics is sometimes used with a PIN or password, hardware authenticators or tokens have traditionally been more widely available and supported.