Catalog
concept#Security#Integration#Platform#Software Engineering

Multi-Factor Authentication (MFA)

A security principle that strengthens authentication by requiring multiple independent factors, e.g. knowledge, possession, or biometric attributes.

Multi-factor authentication (MFA) is a security approach that strengthens identity verification by requiring two or more independent factors such as knowledge, possession, or inherence.
Established
Medium

Classification

  • Medium
  • Organizational
  • Architectural
  • Intermediate

Technical context

Single Sign-On (SAML, OIDC)Identity providers (Azure AD, Keycloak, Okta)SIEM and monitoring systems

Principles & goals

Minimum necessary factors: use only as many factors as required.Defense in depth: MFA complements, it does not replace other security controls.Consider usability: user acceptance is critical to effectiveness.
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • SIM swapping for SMS-based factors.
  • Loss of hardware tokens without robust emergency processes.
  • Misconfigurations that render MFA bypassable.
  • Favor phishing-resistant factors (e.g. FIDO2) over SMS.
  • Use adaptive MFA to balance usability and security.
  • Implement clear emergency and recovery procedures.

I/O & resources

  • Existing identity directory (LDAP, AD, IdP)
  • List of supported authentication factors
  • Risk policies and compliance requirements
  • Active MFA policy and configuration sets
  • Audit logs with second-factor events
  • Reports on adoption and effectiveness

Description

Multi-factor authentication (MFA) is a security approach that strengthens identity verification by requiring two or more independent factors such as knowledge, possession, or inherence. MFA reduces the risk of credential compromise and aids regulatory compliance. Implementation requires integration with identity providers and balancing security, usability, and operational cost.

✔

  • Significant reduction of account takeover via stolen passwords.
  • Supports regulatory and compliance requirements.
  • Increased traceability and forensic capability for authentication events.

✖

  • Not all factors are equally secure (e.g. SMS vs. hardware tokens).
  • Implementation can introduce additional operational overhead.
  • User acceptance can suffer with poor UX and lead to workarounds.

  • Share of MFA-enabled accounts

    Percentage of users who have enabled MFA.

  • Number of prevented account takeovers

    Detected or prevented takeover attempts after MFA rollout.

  • Support tickets for lost factors

    Number relative to user base requiring help for lost factor.

MFA via TOTP for internal tools

A team introduces TOTP authenticators for internal web apps and connects them to existing SSO.

Hardware tokens for admin accounts

U2F/HSM-backed hardware tokens are mandated for privileged accounts.

Push-based MFA with mobile device

Users confirm login requests via push notifications from a trusted authenticator client.

1

Inventory existing authentication flows and IdPs.

2

Risk-based selection of appropriate authentication factors.

3

Define mandatory policies and exception rules.

4

Technical integration with IdP/SSO and testing in pilot groups.

5

Rollout with user communication, training, and support processes.

⚠️ Technical debt & bottlenecks

  • Legacy systems lacking MFA support that require workarounds.
  • Temporary exception accounts not cleaned up.
  • Incomplete logging integration for factor events.
Legacy systems: old systems lacking MFA supportUser acceptance: resistance to extra stepsSupport load: increased helpdesk requests during rollout
  • Accepting SMS codes as sole protection for admin accounts.
  • Storing backup codes in unencrypted notes.
  • Allowing long-term exceptions without review.
  • Overestimating the security of SMS or email factors.
  • Insufficient procedures for factor loss or rotation.
  • Lack of integration into audit and incident processes.
Identity and access management knowledgeBasic understanding of authentication protocols (OIDC, SAML, OAuth)Operational and support skills for token management
Protection of critical data and resourcesCompliance requirements and regulatory mandatesIntegration with identity providers and SSO
  • • Legal constraints regarding biometric data handling
  • • Technical limitations of legacy applications
  • • Budget constraints for tokens, services, and integration