Multi-Factor Authentication

Description

MFA drastically reduces the risk of unauthorized access even when a password is compromised, because the attacker must also possess the second factor. It is one of the most cost-effective security measures.

Different factors provide different levels of protection. Hardware keys and on-device authenticators are more phishing-resistant than SMS codes, but any form of MFA is significantly better than a password alone.

What people often say

• MFA makes an account completely impenetrable.
• SMS verification provides the same level of protection as a hardware key.
• MFA is only needed for administrator accounts.

Covers / does not cover

Covers

• Protecting accounts from login with a stolen password
• Additional verification layer for sensitive operations
• Hindering automated brute force and credential stuffing attacks

Does not cover

• Attacks that bypass MFA in real time by intercepting tokens or sessions
• Social engineering that tricks the user into approving a fraudulent request
• Threats that do not require authentication (e.g., exploitation of a public-facing service)