Multi-Factor Authentication (MFA) Explained

Multi-Factor Authentication (MFA) requires more than one type of verification before granting access to a system.

It significantly reduces the risk of unauthorized access, even if a password is compromised.

Why passwords alone are not enough

Passwords can be guessed, reused, leaked, or phished. Relying on a single knowledge-based factor creates a single point of failure.

MFA introduces additional independent factors to strengthen protection.

Authentication factors (diagram)

MFA requires at least two factors from different categories.

The three main authentication factors

1. Something you know

Password
PIN
Passphrase

2. Something you have

Authentication app (TOTP codes)
Hardware security key
SMS verification code

3. Something you are

Fingerprint
Facial recognition
Other biometric identifiers

True multi-factor authentication requires factors from at least two different categories.

Common MFA implementations

Password + time-based code (TOTP)
Password + push notification approval
Password + hardware security key
Passwordless authentication using device-bound credentials

MFA and Identity & Access Management

MFA is typically implemented as part of a broader Identity & Access Management (IAM) framework.

It strengthens confidentiality by ensuring only authorized users gain access.

MFA and Zero Trust

In Zero Trust models, strong authentication is foundational. Continuous verification may extend beyond initial login.

Limitations of MFA

MFA fatigue attacks

Attackers may repeatedly send authentication prompts hoping users approve one accidentally.

Phishing-resistant vs non-phishing-resistant methods

SMS-based MFA can still be vulnerable to certain attacks. Hardware-based or cryptographic authentication methods are generally more resistant.

User friction

Security improvements must be balanced with usability. Poorly designed MFA systems may encourage unsafe workarounds.

MFA as part of defense in depth (diagram)

MFA is a preventive control that supports layered defense strategies.

Key takeaway

Multi-Factor Authentication reduces the risk of unauthorized access by requiring independent verification methods.

It does not eliminate risk entirely, but it significantly improves resilience when combined with monitoring and response controls.

On this page