[MUSIC]. Hello and welcome back. I'm Jessica and we'll be walking through today's lecture, Multi-Factor Authentication in Healthcare. First let's talk about some key components of multi-factor authentication. In today's lecture, we'll be learning about the definition of Multi-Factor Authentication, the purpose of Multi-Factor Authentication, authentication factors, we'll talk through an example, and we'll conclude with a quiz. What's the definition of Multi-Factor Authentication? The overarching goal is to enhance security by ensuring that only a designated end-user attempting to access a system, after identifying two qualifying pieces of information about themselves that they have elected in the system is validated. We're limiting the unauthorized access by someone who may be attempting to access the system, posing as someone, that should not be accessing the system. An everyday example of this outside of health care could be when you visit your bank and you swipe your ATM card and then you're asked to enter your personal identification number or PIN. The bank is validating that whomever is entering the card into the ATM machine is truly the owner of that card prior to accessing any bank account information. What's the purpose of multi-factor authentication? The goal here is to decrease the risk of inappropriate access being granted when someone's password has been compromised by adding an additional layer of security to protect highly sensitive information. If we look at an example of this, let's go to our primary care, Physician's office. We think we might have the flu. Anything discussed with our primary care provider as a patient, we would want to ensure stays between ourselves, the care team, and the provider. This would be an example of protecting our personal health information by ensuring that multi-factor authentication is in place to verify that whomever is attempting to access an application should truly be accessing the designated application. Authentication factors may include something that you have such a, Bank card, or a USB with a token. Something you know, password, PIN number, your favorite color, your first car. Or something that you are, such as a fingerprint. There's other examples, but these are just the few that we're going to start with. Now, let's walk through an example. If we're an end user and we're attempting to sign in to our enterprise wide e-mail, what's the first step in this process? Generally, we'll launch a URL that will redirect us to a page asking us to authenticate who we are. We'll be asked for a login code. This login code can be generated from our desktop or to a registered device, such as our cellphone. What we see here is an authentication code sent to our registered mobile device. This authentication code is typically available for a designated period of time, so whomever has generated the code will need to timely enter that code back into the login code screen, as you can see here. Now, the end user will verify answer, and the system will validate that the code entered is a genuine code and either permit or deny access. When the code is validated, the end user will receive a successful login screen and they're able to redirect to their application. You'll now watch a demo of a health system employee enrolling in multi-factor authentication for the first time. Take a look and think about some of the various ways in which issues could arise down the road. In the following video, you'll be walking through some of the issues that can arise with Jessica. I was told that in order to begin enrolling in multi-factor authentication, I need to visit a specific URL that stands for Uniform Resource Locator, basically a web address or web link. I'll enter it here. I'm at the main login page. Looks like I need to enter my user ID. I will go ahead and type that in, followed by a domain name at Hopkins, that's at jhu.edu. I'm signed in now. Now I need to enter my password. Then I'll go ahead and click on "Sign in". Looks like more information is required. It says your organization needs more information to keep your account secure. Let me click "Next" to see what needs to be done to get me setup. I'm at another page now and it's saying I need to pull out my smartphone and open an Authenticator app. If I hadn't already downloaded it, I could follow the instructions here on how to download the app, but I already did that, so I'll just go ahead and click "Next". Let's see. On my smart phone, it's asking if I want to allow notifications, sure. I'm going to add my work account and click "Next". Now it looks like my phone needs to scan the QR code that's on this screen. This is going to let me connect the Authenticator app to my work account. I'll go ahead and scan. Let's see. I should be getting a six digit login code. We'll go ahead and click "Next", and should be getting a notification on my smart phone. Yep. I'm going to go ahead and click on "Approve". Then I should be getting a green check on the window. Looks like the notification is approved. I'm going to go ahead and click "Next" again. Let's see if this worked. I'll accept the notification coming to my smartphone and looks like I've been successful and done enrolling. There are actually several methods I can use to sign in to my account or reset my password. My default method is the Authenticator app, but I'm going to add another method for setup. I'll select phone so I can be called or texted with the authentication number as well whenever I need to login. [MUSIC]
