Multi-Factor Authentication (MFA)

Overview

MFA combines factors such as something known, possessed, or inherent to reduce reliance on one credential. Examples include a password plus security key, device-bound passkey with local verification, or account credential plus independent approval.

Two steps are not necessarily two factors when both depend on the same compromised channel. SMS codes, push prompts, and one-time passwords can be phished or intercepted, while recovery processes may bypass strong primary authentication.

Organizations should prefer phishing-resistant factors, bind approval to transaction context, limit prompts, protect enrollment, and secure recovery. Risk-based step-up can improve usability but should not silently weaken protection for high-impact actions. Session theft after successful MFA requires separate token and device protections.

Collecting more sensitive data does not automatically improve security or compliance when provenance, accuracy, proportionality, and deletion obligations are ignored.

A one-time successful test provides bounded evidence for that scope and date, not a permanent guarantee.

Repeated renewal is a signal that the underlying design needs correction.

Teams need verified backups or alternative procedures, clean credentials and configurations, reconciliation steps, decision authority, communication channels, and tests showing that restoration meets objectives.

Improvement should remain governed so feedback does not encode new bias or weakness.

Multi-Factor Authentication requires evidence from at least two independent factor categories; multiple items from one category do not necessarily provide multiple factors.

Multi-Factor Authentication (MFA) is a security mechanism or control discipline that requires evidence from at least two independent factor categories before granting access or approving a sensitive action. MFA is strongest when factors are independent, phishing-resistant, securely enrolled, and supported by equally strong recovery and session controls.