MFA (Multi-Factor Authentication)

MFA (Multi-Factor Authentication) requires evidence from at least two different factor categories, such as something known, possessed or inherent, before granting access. Two passwords are not two factors. MFA reduces the value of a stolen password, but strength varies: SMS, push prompts, authenticator codes, hardware keys and passkeys resist different attacks. Recovery and enrolment paths are part of the control and can become the easiest route around it. Design should cover privileged accounts, legacy protocols, service accounts, phishing resistance, lost devices, fallback and audit logs. Rollout needs representative testing and a controlled exception process. MFA complements secure sessions, least privilege and monitoring; it does not make a compromised device or approved malicious session safe.