KD-012 // PROTECTING IDENTITY SECURITY ARCHIVE 012

HOUSE VENTER // SECURITY INTELLIGENCE

MFA Explained: Why a Password Is No Longer Enough

A password proves that somebody knows a secret. The problem is that secrets can be guessed, reused, stolen, phished or exposed in a breach. Multi-factor authentication adds another independent form of proof before access is granted.

MFA does not make an account impossible to compromise. It makes a stolen password less useful by requiring the attacker to satisfy another authentication factor.

KD-012 // AUTHENTICATION MODEL IDENTITY → FACTOR 01 → FACTOR 02 → ACCESS

01USERNAME

02PASSWORD

03MFA

04VERIFY

05POLICY

06ACCESS

07SESSION

PASSWORD // SOMETHING YOU KNOW MFA // MORE THAN ONE FACTOR TYPE

KD-012 // EXECUTIVE BRIEF ONE SECRET IS A SINGLE POINT OF FAILURE

Your Password Can Be Strong and Still Be Stolen

Strong, unique passwords remain important. But password strength does not protect against every way credentials are lost. A convincing phishing page can capture a password. Malware can steal credentials. A reused password can be exposed by another breached service.

MFA reduces reliance on that single secret. NIST defines multi-factor authentication as authentication using more than one distinct factor, such as something you know, something you have, or something you are.

That distinction matters: two passwords are not two factors. Two pieces of information from the same factor category are still single-factor authentication.

CENTRAL QUESTION If an attacker already has your password, what else must they prove before the system trusts them?

THE PASSWORD PROBLEM

Passwords Are Useful — but They Are Copyable Secrets

A password is knowledge. If you know the correct secret, the system can use that knowledge as evidence that you are the legitimate user.

The weakness is that knowledge can be copied. An attacker does not need to physically possess your computer to type a password that has been stolen somewhere else.

This is why password security has two jobs: make the password difficult to guess and reduce the damage if somebody obtains it anyway.

RISK // 01Phishing

A fake sign-in page can trick a user into handing credentials directly to an attacker.

RISK // 02Password Reuse

A credential exposed at one service may be tried against other accounts.

RISK // 03Malware

Malicious software can attempt to steal credentials, tokens or other authentication data.

RISK // 04Weak Secrets

Short, predictable or common passwords are easier to guess or crack.

THE FACTORS

MFA Means Different Types of Evidence

Authentication factors are commonly grouped into categories. MFA combines evidence from more than one category rather than simply asking the same type of question twice.

That is what creates the extra barrier. Compromising one factor should not automatically provide the other.

FACTOR // 01Something You Know

A password, passphrase or PIN — information held in the user's memory.

FACTOR // 02Something You Have

A registered authenticator, security key, phone or other possession-based authenticator.

FACTOR // 03Something You Are

A biometric characteristic used as part of an authentication process.

AUTHENTICATION RULE

Password + security question is not MFA if both are simply knowledge factors. More prompts do not automatically mean more factors.

HOW IT HELPS

A Stolen Password Stops Being the Whole Key

Imagine an attacker successfully captures your email password through a phishing page.

With password-only authentication, possession of that credential may be enough to attempt access. With MFA enabled, the service can demand another valid factor before completing authentication.

The attacker's problem changes from “steal the password” to “steal the password and defeat the additional authentication control.”

SIMPLE ATTACK FLOWMFA ADDS ANOTHER GATE

01PHISH

The attacker captures the user's password.

02LOGIN

The stolen password is submitted to the real service.

03MFA CHECK

The service requests another authentication factor.

04BLOCK / VERIFY

Access depends on whether that additional factor can also be satisfied.

NOT ALL MFA IS EQUAL

The Second Factor Matters

“MFA enabled” is not the end of the discussion. Different authentication methods resist different attacks.

SMS codes and one-time codes can still provide an important additional barrier compared with a password alone, but codes can be phished or intercepted in some attack scenarios.

Modern security guidance increasingly favours phishing-resistant authentication for higher-value accounts because the authentication mechanism is designed to resist credential capture and replay through a fake website.

METHOD // 01SMS / Voice Codes

Better than password-only access in many situations, but vulnerable to attacks involving phishing, number takeover or interception.

METHOD // 02Authenticator Codes

Time-based one-time passwords avoid reliance on SMS, but a user can still be tricked into entering a current code into a phishing site.

METHOD // 03Push Approval

Convenient, but simple approve/deny prompts can be abused through repeated requests or social engineering.

METHOD // 04Passkeys / Security Keys

Standards-based cryptographic authentication can provide phishing-resistant protection when correctly implemented.

MFA FATIGUE

Never Approve a Login You Did Not Start

Some MFA systems send a push notification asking the user to approve or deny a sign-in. That convenience creates a human decision point.

If an attacker already knows the password, they may repeatedly trigger prompts and hope the user eventually approves one simply to make the notifications stop. This is often called MFA fatigue or push bombing.

An unexpected authentication prompt is a warning, not an inconvenience to dismiss. If you did not initiate the login, deny it and investigate the account.

USER RULE

Never approve an MFA request just because it appeared on your phone. Approval should correspond to a login you deliberately initiated.

PHISHING RESISTANCE

Why Passkeys and Security Keys Change the Game

Traditional passwords and one-time codes can be typed into the wrong website because the user is responsible for deciding whether the site is genuine.

FIDO-based authentication, including appropriately implemented passkeys and hardware security keys, uses public-key cryptography and binds authentication to the legitimate service. The private credential does not need to be handed to the website like a reusable password.

NIST's current Digital Identity Guidelines require phishing-resistant authentication at higher assurance levels and explicitly identify WebAuthn/FIDO2 as an example of phishing-resistant authentication.

AUTHENTICATION // SIMPLIFIEDSHARED SECRET VS CRYPTOGRAPHIC PROOF

TRADITIONAL PASSWORDReusable Secret

The user sends knowledge of a secret to prove identity. If that secret is stolen, another person can attempt to reuse it.

PASSKEY / FIDOCryptographic Authentication

The authenticator proves possession of the private credential without sending that private key to the service.

MFA IS NOT MAGIC

Multi-Factor Authentication Can Still Be Defeated

MFA significantly improves account security, but it does not make compromise impossible.

Attackers can use social engineering, real-time phishing proxies, stolen session tokens, compromised endpoints, account-recovery abuse and other techniques to bypass or work around some authentication controls.

The lesson is not that MFA is useless. It is that MFA is a security layer, not a force field. Stronger phishing-resistant methods reduce important classes of attack further.

BOUNDARY // 01Session Theft

An attacker who steals a valid authenticated session may attempt to bypass the normal login process.

BOUNDARY // 02Social Engineering

A user can still be manipulated into approving or revealing authentication information.

BOUNDARY // 03Compromised Device

Authentication cannot compensate for every threat on a device that is already under attacker control.

WHERE TO START

Protect the Accounts That Can Unlock Everything Else

If you cannot enable stronger authentication everywhere at once, start with accounts whose compromise would give an attacker access to other systems or recovery mechanisms.

Email deserves particular attention because password-reset messages for many other services are delivered there. Administrator, cloud, financial and business-critical accounts are also high-value targets.

For businesses, MFA should form part of a wider identity policy rather than being enabled randomly on whichever service somebody remembers first.

PRIORITY // 01Email

Often controls password recovery and sensitive business communication.

PRIORITY // 02Administrator Accounts

Privileged identities can make broad changes to systems and services.

PRIORITY // 03Cloud Services

Business data and applications increasingly depend on online identities.

PRIORITY // 04Financial & Critical Systems

Accounts with high business impact deserve stronger authentication controls.

RECOVERY

Secure the Way Back In Too

MFA introduces another practical responsibility: account recovery. Phones are replaced, authenticators can be lost and hardware keys can fail or disappear.

Recovery methods should be configured deliberately and stored safely. Backup codes, secondary authenticators or recovery procedures can prevent a legitimate user from being permanently locked out.

But recovery must not become the weak back door. An account protected by strong MFA is only as strong as the process that can bypass or reset it.

RECOVERY PRINCIPLE

Plan account recovery before you need account recovery. Do not wait until the only authenticator is lost.

THE PRACTICAL RULE

Use Strong Passwords — Then Stop Asking Them to Work Alone

MFA does not make good password practice obsolete. Unique passwords still reduce credential-reuse risk, and a password manager can make unique credentials practical.

But a password should no longer be expected to carry the entire identity-security burden by itself when a service offers stronger authentication.

For important accounts, enable MFA. Where the service supports a phishing-resistant method such as a passkey or security key, consider using it — particularly for privileged and high-impact identities.

HOUSE VENTER // IDENTITY RULE

Make the password strong. Make it unique. Then add another independent barrier.

KD-012 // FIELD CONCLUSION IDENTITY DEFENCE // UNDERSTOOD

FINAL ASSESSMENT

A Password Is Still Important. It Just Shouldn't Stand Alone.

A strong password protects a secret. MFA protects against the possibility that the secret is no longer secret.

Different MFA methods provide different levels of resistance, and modern phishing-resistant authentication can offer stronger protection than methods based on manually entered one-time codes.

The goal is not to make logging in annoying. It is to make stolen credentials insufficient.

KNOWLEDGE DOCK // FINAL PRINCIPLE

One credential proves knowledge. Multiple independent factors build confidence in identity.

HOUSE VENTER // FIELD APPLICATIONPROTECTING // IDENTITY IS PART OF THE ATTACK SURFACE

FOUR PILLARS // 01

Protecting the Endpoint Is Not Enough If the Identity Can Simply Be Stolen

House Venter's Protecting pillar includes endpoint security, but modern IT security also depends on the accounts used to reach applications, cloud services and business data.

MFA is therefore not a replacement for endpoint protection. It addresses a different part of the problem: proving that the person attempting to sign in is more likely to be the legitimate user.

01 // PROTECTINGEndpoint & Identity Security

Reduce the chance that malicious software or stolen credentials become successful access.

02 // MONITORINGRMM & Visibility

Maintain operational visibility around supported technology.

03 // BACKING UPManaged Cloud Backup

Maintain a recovery path for included business data and systems.

04 // SUPPORTINGHuman IT Support

Help users configure, understand and troubleshoot the technology they depend on.

KD-012 // INTELLIGENCE SUMMARY

Six Points to Remember

INTEL 01Passwords Can Be Stolen

Strength matters, but phishing, reuse and malware can expose credentials.

INTEL 02MFA Uses Different Factors

Real MFA combines independent categories of authentication evidence.

INTEL 03Methods Differ

SMS, authenticator codes, push prompts and cryptographic authenticators do not resist every attack equally.

INTEL 04Phishing Resistance Matters

Passkeys and security keys can provide stronger protection against credential-phishing attacks.

INTEL 05MFA Is Not Invincibility

Sessions, endpoints, recovery processes and users themselves can still be attacked.

INTEL 06Recovery Needs Planning

Secure backup authentication and recovery methods before an authenticator is lost.

PROTECT THE PASSWORD // ADD ANOTHER FACTOR // STRENGTHEN THE IDENTITY

KD-012 // RESEARCH REFERENCES

Authentication-factor definitions and current phishing-resistant authentication guidance reviewed against NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management. NIST SP 800-63B

Practical MFA guidance and phishing-resistant MFA recommendations reviewed against the U.S. Cybersecurity and Infrastructure Security Agency. CISA MFA Guidance

Passkey and FIDO authentication architecture reviewed against the FIDO Alliance's current passkey resources. FIDO Alliance