Scaling Multi-Factor Authentication Across Government Agencies

As a government agency that has implemented multi-factor authentication (MFA), you’re part of a growing trend. According Forrester Technographics, 50% of organizations want to add two-factor authentication as an option in the next 12 months while another 50% already implement two-factor authentication.

Your Constituency Expects Maximum Efforts to Secure Data

Whether it's related to public safety or constituent personal identifiable information, governments must take the highest precautions to make sure only those employees with the proper permissions are granted access. One challenge you may be facing with MFA is scaling its deployment across your organization. We recommend that you think about how to manage MFA across multiple devices and perhaps locations in your organization, as well as which types of MFA work best for your needs.

Managing MFA

Technologies such as Intel® Authenticate—available on devices with 8th Gen Intel® vPro™ Technology—simplify MFA scaling. It gives IT the flexibility to create and deploy custom MFA policies that enforce user identity protection. The IT administrator can mix and match identification factors for different users and provide varying levels of access across the corporate domain, network, VPN and more. Intel Authenticate provides a simple self-service enrollment tool for end users to quickly get started, eliminating calls to IT.

Enabling True "Hardware" Authentication

Lenovo recommends using MFA grounded in hardware. This MFA type is much harder for hackers and malicious code to snoop and capture password data because it's located deep in the silicon, isolated from the OS and applications.

There are several ways to authenticate users and ensure that the credentials are stored at the hardware level, and you can use Intel Authenticate to set up different combinations of the following:

  • Facial Recognition: Infrared (IR) cameras are more secure than regular cameras for facial recognition. In addition, ThinkPad Glance utilizes face-, eye- and gaze-tracking to automatically lock a device if the user is not present.
  • Fingerprints: Lenovo Match on Chip Fingerprint Reader (MoC FPR) stores biometric credentials on a separate chip, making it almost impossible to hack.
  • PIN: Short PIN codes can be used alongside other authentication factors as part of an MFA solution.
  • Consider the following as supplementary MFA factors:
    • Phone Proximity: Users can pair their smartphone with their PC via Bluetooth and securely use the proximity of their phone as an authentication factor.
    • Location: Use location-based services to determine if a user is in an expected location like their office.

As you look to update your access management strategy, you'll need modern devices to support and scale hardware-based MFA and the convenience of solutions such as Windows Hello.

Scaling Multi-Factor Authentication Across Government Agencies

This move to increase emphasis on multifactor authentication comes at a critical time of digital transformation within government agencies and beyond ...two-factor authentication will add more convenience and additional layers of security.

Darren Guccione, CEO of Keeper Security


  • Lenovo's Match on Chip Fingerprint Reader, available on many ThinkPads, stores biometric credentials on a separate chip, making it harder for malicious code to capture authentication data.
  • Intel® Authenticate - available on some Lenovo devices - simplifies MFA scaling by enabling IT to mix and match identification factors for different users.
  • Some Lenovo devices support Facial Recognition technology. In addition, ThinkPad Glance utilizes face and eye-tracking to automatically lock and unlock a device based on the presence of the user.