Multi-Factor Authentication (MFA).

What is multi-factor authentication?

NIST defines multi-factor authentication (MFA) as authentication using two or more different factors. A password alone is one factor. MFA asks for another kind of proof before it lets you in. MFA with exactly two factors is often called 2FA.

What are the three factors?

NIST names three types of factor. Each one is a different sort of evidence.

• Something you know, such as a password or a PIN.
• Something you have, such as a token or an authentication app.
• Something you are, such as a fingerprint or other biometric.

OWASP stresses that two factors of the same type, such as a password and a PIN, do not make MFA. The factors must be different.

How does MFA work?

You give your password first. The service then asks for a second proof before it grants access. CISA says that even if an attacker compromises one factor, such as your password, they will be unable to meet the second requirement. CISA also says users who enable MFA are significantly less likely to be hacked.

Where should you turn MFA on?

CISA lists email, financial services, social media, online stores and entertainment streaming as places to turn MFA on.

How do attackers get around MFA?

As a simple illustration, an attacker may hold a stolen password and still need the second factor. So attackers look for ways to defeat that step. OWASP describes MFA fatigue, where attackers repeatedly send push notifications hoping the user eventually approves one. OWASP notes that NIST treats SMS codes as a restricted authenticator, because of SS7 interception, SIM-swap and number-porting attacks. In a SIM swap, an attacker moves a victim’s phone number to get the codes.

How can you make MFA stronger?

• Prefer phishing-resistant methods. CISA says the only widely available phishing-resistant authentication is FIDO/WebAuthn.
• Use number matching, which CISA says can help prevent push bombardment.
• Rate-limit or cap push notifications, as OWASP advises.
• Avoid SMS for applications that handle sensitive data. OWASP says SMS should not protect applications that handle personal or financial data.

CISA urges organizations to plan a move toward FIDO.

How does MFA relate to nearby terms?

MFA is about proving identity at login. Related terms in this glossary include phishing, which is a common way to try to get passwords, and initial access broker.

Is MFA the same as 2FA?

Nearly. 2FA uses exactly two factors. MFA is the wider term and means two or more.

Is any MFA good enough?

CISA says any MFA is better than no MFA, though stronger implementations are preferable. Some methods are stronger than others.