Skip to content

THE IMPORTANCE OF MFA

According to TeleSign – More than half of consumers (54 percent) use five or fewer passwords across their entire online life, while 22 percent use just three or fewer

Reusing passwords is extremely dangerous and can cause a “domino effect” that allows bad actors to gain access to multiple accounts after just cracking one password.

These poor password practices highlight how powerful implementing Multi-Factor Authentication (MFA) can be while having minimal impact on the user’s authentication experience.

WHAT IS MFA?

Multi-Factor Authentication is an authentication process that requires you to provide two or more verification methods to login and gain access to a resource such as email, Office 365 or a VPN.

MFA is the core component of strong authentication as part of your identity and access management (IAM) policy.

THE MOST COMMON FACTOR IS A CODE OR PUSH PROVIDED BY AN APP

WHY MFA?

Over 80% of hacking-related breaches are caused by stolen or weak passwords. It’s about utilizing multiple factors to reduce the risk of a weak or compromised password being used.

MFA VS 2FA

These methods are often confused and are actually different. 2FA is ultimately a subset of MFA, the core difference being that 2FA is limited to TWO factors whereas MFA can have multiple factors.

MFA EXAMPLES

Generally, Multi-Factor Authentication will require you to use a combination of methods:

Knowledge-based

  • A password
  • Personal security questions (first school, pets name)

Physical

  • One-time password from a smartphone application
  • One-time password via SMS or email
  • Access cards, USB devices and Smart cards

Personal

  • Fingerprint
  • Facial recognition
  • Location
MFA FATIGUE (PRO TIP)

An “MFA fatigue” attack can be when a bad actor utilises scripts to login repeatedly, generating what feels like a never-ending stream of MFA push requests.

Often users will eventually or mistakenly approve one of these logins.

Implementing solutions such as Microsoft Authenticator number matching are a brilliant way of avoiding falling foul of these types of attacks.

If you have any questions on the aspects discussed in the blog post or would like us to review your environment please get in touch!