Multi-factor authentication: what it is

In short

Authentication factors fall into three categories:

• something you know: password, PIN;
• something you have: a smartphone with an app, a physical security key, a smart card;
• something you are: fingerprint, face recognition.

It is only MFA if the factors belong to different categories: two passwords do not make multi-factor authentication. With two factors it is also called 2FA or two-step verification.

How it works

Not all methods offer the same protection. From weakest to strongest:

1. SMS code: better than nothing, but exposed to fraudulent SIM swapping and interception;
2. time-based code from an app (TOTP), which changes every 30 seconds;
3. push notification to approve: convenient, but vulnerable to "MFA fatigue", when the attacker sends request after request until the user approves; number matching reduces the problem;
4. FIDO2 security keys and passkeys: resistant to phishing, because they only work on the genuine site.

Why it matters

Many intrusions start from valid credentials: stolen through phishing, bought on the dark web or guessed. MFA stops the great majority of these attempts. Article 21 of the NIS2 Directive lists among the minimum measures the use of multi-factor authentication or continuous authentication solutions, where appropriate.

The priorities, if you cannot switch it on everywhere straight away: email and cloud suite, remote access (VPN, remote desktop), administrative accounts, business applications holding sensitive data or payments. Watch out for forgotten exceptions: service accounts, legacy mail protocols and supplier accounts that bypass MFA are attackers' favourite route.

Example

A technician's password ends up in a collection of stolen credentials. An attacker tries it on the company VPN at night: the password is correct, but the VPN asks for the code from the authenticator app, which the attacker does not have. Access is refused and the failed attempt stays in the logs, where the monitoring system flags it. The technician changes the password the next morning; without MFA, the attacker would already have been inside the network.

Two precautions complete the example: MFA recovery codes must be kept somewhere safe, and the procedure for resetting the second factor for someone who changes phone must verify the person's identity. Many attackers target the help desk precisely for this.

Related terms

• Phishing
• Hardening
• System administrator
• Dark web