What Is Multi-Factor Authentication (MFA)?

What Is Multi-Factor Authentication?

Multi-factor authentication (MFA) requires users to verify their identity using two or more independent factors before gaining access to a system or application. The three categories of authentication factors are: something you know (a password), something you have (a phone, hardware token, or smart card), and something you are (a fingerprint or face scan). By requiring at least two of these, MFA ensures that a stolen password alone is insufficient to compromise an account.

Why Passwords Alone Are Not Enough

Passwords are consistently the weakest link in access security. Password reuse means that credentials stolen from one breach work against other services. Phishing harvests credentials directly from users. Dictionary and brute-force attacks crack weak passwords. Data breach repositories contain billions of credential pairs that attackers use for credential stuffing — trying known username/password combinations across hundreds of services simultaneously. A password that is unique and strong on one service can still be compromised if a third-party site where you used the same password is breached.

Types of MFA

• SMS codes — A one-time code sent to a registered phone number. Better than no MFA, but vulnerable to SIM-swapping attacks. NYDFS specifically identifies SMS as a weak MFA method and recommends stronger alternatives.
• Authenticator apps (TOTP) — Time-based one-time passwords generated by an app (Google Authenticator, Microsoft Authenticator). Stronger than SMS, not vulnerable to SIM-swapping, but still susceptible to real-time phishing attacks.
• Push notifications — An app on the user's phone prompts them to approve a login. Convenient but vulnerable to MFA fatigue attacks where attackers send repeated prompts until a user approves accidentally.
• FIDO2/Hardware keys — The strongest form of MFA. A physical security key (YubiKey, Google Titan) or device-bound passkey that requires physical possession and is immune to phishing and remote attacks. Required by NYDFS for privileged accounts.

Where MFA Must Be Applied

MFA should be required for every external-facing access point without exception: email (including web-based access), VPN, cloud services, remote desktop, administrative portals, and any application containing sensitive data. NYDFS Part 500 requires MFA for all users accessing any information system as of November 2025. Most cyber insurance carriers require it as a condition of coverage.

What Penetration Testing Reveals About MFA

One of the most common findings in network penetration tests is MFA that is enabled in theory but not fully enforced in practice — accounts with exemptions, legacy applications with MFA bypassed, or administrative accounts without MFA. A penetration test validates whether your MFA implementation actually works under adversarial conditions.