Wiki › Defensive Strategies & Controls › Preventive Controls › Multi-Factor Authentication

Multi-Factor Authentication

1 min read

Jump to:

Overview

Multi-Factor Authentication (MFA) is a security control that requires users to provide two or more verification factors to gain access to a system or application. It enhances cybersecurity by adding layers of defense beyond just passwords, reducing the likelihood of unauthorized access.

Security Objectives

Ensure strong user authentication to prevent unauthorized access
Reduce risks associated with compromised credentials
Enhance system resilience against identity-based attacks

Where It Is Applied

Access control mechanisms across network, application, and endpoint layers
Cloud services, enterprise systems, remote access workflows, and privileged accounts
Operational contexts requiring elevated security for sensitive data or critical functions

How It Works (High Level)

MFA requires users to verify their identity by presenting multiple independent credentials from different categories, such as something they know (password), something they have (token or device), or something they are (biometric). Access is granted only when all required factors are successfully validated.

Benefits and Limitations

Significantly reduces the risk of account compromise and credential theft
Improves compliance with regulatory requirements for strong authentication
May introduce user friction and require additional resources for deployment and management
Potential vulnerabilities if one or more factors are weak or improperly implemented

Operational Considerations

Requires infrastructure to support multiple authentication methods and factor verification
Needs integration with existing identity and access management systems
Challenges include user adoption, factor availability, and balancing security with usability