Passwords alone protect accounts only inadequately. They are guessed, published in data leaks, reused, or captured via phishing. Multi-factor authentication supplements the password with at least one additional proof and is therefore considered one of the most effective individual measures against account takeovers. With exactly two factors, this is also called two-factor authentication (2FA). The NIS2 Directive explicitly lists multi-factor authentication among the measures for managing cybersecurity risks, where appropriate.
How does multi-factor authentication work?
The factors come from different categories:
- Knowledge: something only the person knows, such as a password or PIN.
- Possession: something the person has, such as a smartphone, hardware key, or smart card.
- Inherence: a physical characteristic such as a fingerprint or face.
What matters is that the factors come from different categories. Two passwords do not make MFA.
The methods differ significantly in their security. SMS codes are better than no second factor but can be intercepted or obtained through deception. One-time codes from an authenticator app and push approvals are widespread but can also be circumvented by sophisticated phishing. Methods based on the FIDO2 standard, such as hardware security keys and passkeys, are considered phishing-resistant because they are cryptographically bound to the genuine website.
Typical examples
- Signing in to Microsoft 365 with a password and approval in an authenticator app.
- VPN access for the home office with an additional one-time code.
- Administrator accounts that can only be used with a hardware security key.
- Access to remote maintenance tools and to the management interfaces of firewalls or servers.
- Approving a transfer in online banking on a registered device.
What companies should keep in mind
- Enable MFA for all accounts, starting with administrators, remote access, email, and cloud services.
- Disable legacy authentication protocols that do not support MFA and can therefore bypass it.
- Use push approvals only with number matching so that mass-triggered requests ("MFA fatigue") do not lead to a careless approval.
- Use phishing-resistant methods for particularly sensitive accounts.
- Define processes for lost devices and for resetting factors, because the help desk can also be a target of social engineering.
How it differs
MFA describes the verification of identity at sign-in. Conditional Access additionally decides, based on context such as device, location, or risk, whether and with which factors a sign-in is allowed.
View security services