Multifactor authentication (MFA) verifies identity with a combination of factors: something you know, such as a password, plus something you have, such as a time-sensitive code, or something you are, such as biometric data. It adds protection when passwords are weak, reused, or stolen. section 7.1.1
Choose an approach that fits the risk of the asset being protected:
- Hardware tokens and smart cards provide a physical source of authentication codes; software tokens generate codes in an app or device. section 7.1.1
- Biometrics can complement passwords, but sensitive biometric data needs special handling because of privacy concerns. section 7.1.1
- Context-aware MFA adapts to factors such as user behavior, location, or device. section 7.1.1
Close a remote-access gap
After a phishing email exposed an employee’s credentials, an attacker accessed a financial institution’s server. Investigators identified the absence of MFA on remote access as a critical vulnerability. The institution enabled MFA at all remote access points alongside phishing training and stronger monitoring. section 9.5.1
Treat MFA as a measurable access-control improvement, not a complete fix. One organization introduced it across critical systems to reduce access violations. In another IAM improvement effort, MFA contributed to an authentication success rate of 95%; continued monitoring remained necessary to spot failures that might signal an attack. section 3.3.5 section 7.1.11
