Unfortunately, none of these tools individually provide strong user authentication. For this reason, if you are using any of the more advanced products listed above to protect data and systems, you should seriously consider using strong user authentication as well. The most critical factor to consider in deciding whether strong authentication is required is the cost associated with unauthorized access to the data in question. It may not pay to have a strong user authentication tool to control access to low risk data, but higher risk data will likely warrant the user accountability that strong authentication provides. Another factor to consider is corporate liability.
Downstream liability is a new concept with some large implications.
Current law holds that the third party can sue not only the perpetrator of the act, but also any other parties involved in the act, including the company that owned the network used as the jumping-off point for the attack. In this example, strong user authentication can demonstrate that the company has not been overly negligent in implementing preventive controls. The final factor to consider is the state of currently available technology. The definition of strong authentication will change as technology advances. Any strong user authentication tool must continue to evolve with the demands of new techniques and threats.