What is multifactor authentication (MFA)?
Multifactor authentication (MFA) is a way to keep accounts secure by asking users for two or more types of proof to confirm their identity. These can be something you know, like a password; something you have, like a security token or an app on your phone; or something you are, like a fingerprint or face scan.
Using more than one of these makes it much harder for attackers to break in, even if they get hold of one piece of information. Why multifactor authentication shouldn’t be your only defense
MFA does make accounts safer, but it is not perfect. Attackers have found ways to get around it, such as:
- Social engineering: Tricking users into revealing MFA codes or credentials through phishing, impersonation, or manipulation.
- MFA fatigue attacks: Bombarding users with repeated authentication requests until they approve a malicious attempt out of annoyance or confusion. (Bailey & Courtney, 2024)
- Weak backup methods: Exploiting less secure backup authentication options, such as recovery codes sent to email accounts that may themselves be vulnerable.
- Seed compromise: If the secret used to generate one-time codes is stolen, attackers can generate valid codes themselves.
Because of these risks, using only MFA can still leave organizations open to attacks from determined hackers. What to use in addition to MFA
To stay better protected, organizations should use other security tools along with MFA, such as:
- Zero trust architecture: Assumes every login could be compromised and continuously verifies users and devices, looking at context like location and device behavior. (Rose et al., n.d.)
- Endpoint detection and response (EDR): Watches user devices in real time for anything suspicious and reacts quickly to threats that might get past the first security checks. (What is EDR? Endpoint Detection & Response Defined, 2022)
- Mobile endpoint security: Keeps smartphones and tablets safe from malware, phishing, and other dangers. This is especially important now that many people work remotely or use their own devices for work. (Securing a Remote Workforce: Future-Proofing Your Organization Against Cyber Threats, n.d.)
When organizations use MFA together with these extra security steps, they can lower their chances of a breach, even if one layer of protection fails.
Jaspreet Singh — Author @ MSPinsights.ca | Founder & CEO, Accelerate IT Services Inc.