Multi-Factor Authentication (MFA)
A B C D E F G H I K L M N O P Q R S T U V W Z
Contents:

What Is Multi-Factor Authentication?

Multi-Factor Authentication (MFA) is a security mechanism that requires users to verify their identity through two or more independent authentication factors before accessing an account or system. Rather than relying solely on a password, MFA adds additional verification steps that an attacker would need to satisfy even if they possessed the user’s credentials.
MFA is one of the most effective available controls against credential-based attacks. Stolen passwords are the most common initial access vector in security breaches. MFA removes the utility of stolen credentials by requiring the attacker to also control a second factor that is physically or logically separate from the password.

Authentication Factors

Something you know: A password, PIN, or security question answer. This is the most common factor but also the most vulnerable to theft through phishing, data breaches, and brute-force attacks.
Something you have: A physical device or token that generates or receives a verification code. Examples include authenticator apps, hardware security keys, and SMS-based one-time codes.
Something you are: Biometric characteristics unique to the user: fingerprint, facial geometry, iris pattern, or voice recognition. Biometric factors are highly resistant to theft but require compatible hardware and appropriate privacy controls.

MFA Methods

Authenticator Apps

Applications like Microsoft Authenticator and Google Authenticator generate time-based one-time passwords that refresh every 30 seconds. They are more secure than SMS-based codes because they do not depend on cellular networks or phone number portability, both of which are vulnerable to SIM-swapping attacks.

Hardware Security Keys

Physical devices such as YubiKeys implement FIDO2/WebAuthn standards to provide the strongest form of MFA. They require physical possession of the key and cryptographically verify the legitimate domain the user is authenticating to, making them resistant to phishing attacks that fool other MFA methods.

Push Notifications

Authentication apps send push notifications to the registered device asking the user to approve or deny a login attempt. While convenient, push-based MFA is vulnerable to MFA fatigue attacks where attackers send repeated approval requests hoping a user will accidentally approve one.

SMS One-Time Codes

A one-time code sent via text message is the most widely deployed MFA method due to its simplicity and lack of app installation requirements. It is also the most vulnerable, as SMS is susceptible to SIM-swapping and interception. SMS MFA is significantly better than no MFA but should be upgraded to app or hardware-based methods for accounts with significant risk exposure.

MFA in Enterprise IT and Compliance

MFA is mandated or strongly recommended by virtually every major security compliance framework, including SOC 2, ISO 27001, PCI DSS, HIPAA, and NIST SP 800-63. Cyber insurance underwriters increasingly require MFA on all remote access, email, and privileged accounts as a baseline coverage condition. For organizations using Microsoft 365, Entra ID Conditional Access enables granular MFA enforcement policies based on user, device, location, and application.

Key Takeaways

  • MFA requires two or more independent verification factors before granting access, removing the utility of stolen credentials alone.
  • The three factor categories are something you know, something you have, and something you are.
  • Hardware security keys implementing FIDO2/WebAuthn provide the strongest MFA protection, including resistance to phishing attacks.
  • SMS-based MFA is the most common but most vulnerable method; organizations should prioritize app-based or hardware-based alternatives for high-risk accounts.
  • MFA is a baseline requirement in most security compliance frameworks and increasingly a cyber insurance coverage condition.
Scroll to Top