MFA Types: What Each One Is Actually Worth

Multi-factor authentication is the best value-for-money security control an organisation can deploy. Credential theft is the most common initial intrusion vector, and MFA stops the great majority of it.

"MFA" is however an umbrella term, and the methods differ by orders of magnitude. This article covers what each one actually protects against.

The five methods, by strength

Why code-based MFA does not stop phishing

This is the point most often misunderstood. Modern phishing does not want to capture the password; it relays the sign-in in real time.

The user arrives at a fake but pixel-perfect sign-in page. They enter the password, which the attacker immediately forwards to the real service. The service asks for a code, the fake page asks for a code, the user types it, the attacker forwards it. Sign-in succeeds, and the attacker receives the session cookie, after which they log in without any code at all.

The whole exchange takes seconds, and the user notices nothing, because they do end up inside the system.

FIDO2 differs because authentication is cryptographically bound to the domain. A hardware key or passkey simply will not respond on a different domain, so the proxy attack fails. This is not a matter of policy or configuration but follows from how the protocol works.

Where to start

Not everything at once. This order delivers the greatest risk reduction.

1. Every externally reachable service. VPN, remote desktop, webmail, cloud applications. That is the front door.

2. Administrative accounts. Ideally hardware keys, immediately. Few accounts are involved, so it is cheap, and this is where the greatest damage can be done.

3. High-risk roles. Finance, HR, executives, IT.

4. All users. At least at number-matched push level.

5. Eliminating exceptions. See below.

Exceptions are the most dangerous part

An MFA rollout fails when a hole remains. The typical exceptions:

Legacy protocols. Older mail authentication methods (POP3, IMAP, SMTP with basic authentication) do not support MFA. If left enabled, the attacker simply uses those. Disable them rather than granting an exception.

Service accounts. Interactive MFA is not possible for these. The answer is not an exception but: long unique stored passwords, tight privilege restriction, sign-in location restrictions, and regular review.

"Just not for the executives." This comes up regularly for convenience. Executives are the most targeted group, so it should be the reverse.

Trusted network. The "no MFA from the internal network" rule assumes the internal network is safe. In a typical incident the attacker works from exactly there.

Cost and rollout

Software MFA is typically included in existing subscriptions. In many organisations the capability exists and is simply switched off.

Hardware keys cost a modest amount per device. Not everyone needs one: covering administrators and executives is already an order-of-magnitude improvement.

Passkeys are a free alternative: the key is stored in the phone or the laptop's biometric module, delivering FIDO2-level protection without buying hardware. Today this is the best value route to phishing resistance.

Backup method. Every user needs a second option (a second key, backup codes in a safe, or a defined recovery process), otherwise the first lost phone forces the helpdesk to disable MFA, and that account is defenceless from then on.

What it satisfies in compliance

MFA is named explicitly in several frameworks:

• NIS2, measure 10: multi-factor authentication and secure communications, as an express expectation.
• ISO 27001 A.5.17 and A.8.5: management of authentication information, secure authentication.
• Cyber insurance: most insurers now make it a condition, and its absence can be grounds for declining a claim.

The practical consequence of the last point is that in an environment without MFA, insurance may not pay out even where a policy exists.

The OT environment

In industrial environments user-level MFA has limited application: a shift operator at an HMI will not be inserting a key every minute.

Where it is mandatory, however, is remote access. Supplier maintenance channels are the most common routes onto the plant network, and MFA there is not a convenience question. A central, MFA-protected entry point with on-demand activation and session recording is one of the highest-yield elements of an OT security programme.

We covered this in detail in our ICS/SCADA article, and the broader authentication picture in the Zero Trust guide.