Multi-Factor Authentication (MFA)

The three authentication factors are something you know, such as a password or PIN, something you have, such as a token or cryptographic identification device, and something you are, such as a biometric. MFA can be performed with a single authenticator that provides more than one factor or with a combination of authenticators that provide different factors.

MFA was created to address the weaknesses of passwords: they can be shared, users can be tricked into giving them away through phishing, and people reuse the same or similar passwords across services. With MFA enabled, an attacker who has a password but cannot provide the second factor cannot access the account. This mitigates brute force guessing and credential stuffing and stops some common techniques such as password spraying.

Not all forms of MFA are equally secure. One-time passwords and push notifications that ask the user to approve a login generally do not protect against phishing, because a phishing site can capture a code and replay it to the legitimate site. Attackers also use push bombing, which floods a user with prompts until one is accepted, and SIM swaps or SS7 protocol weaknesses to obtain codes sent by text message or voice. CISA treats SMS and voice codes as a last resort.

Phishing-resistant MFA is the most secure form. The only widely available type is FIDO/WebAuthn authentication, using separate physical tokens or authenticators built into laptops and phones. A less widely available type is tied to an enterprise PKI, such as the smart cards government agencies use. Any form of MFA is still better than none.