Factor categories
- Something you know, such as a password or PIN
- Something you have, such as a hardware authenticator or enrolled device
- Something you are, such as a biometric characteristic
What MFA changes
MFA reduces the value of a stolen password, but it does not eliminate account takeover. Attackers may target session tokens, weak recovery processes, push fatigue, enrollment, or help-desk workflows.
Stronger implementations
Phishing-resistant methods bind authentication to the legitimate service and reduce the usefulness of captured credentials. High-risk access should favor stronger authenticators and controlled recovery.
Program considerations
Coverage, enrollment, exceptions, device loss, recovery, privileged access, service accounts, logging, and user support all affect the real strength of an MFA program.
BMC v0.2.2 cornerstone expansion
Start analysis of Multifactor Authentication with the mission or business outcome, then identify assets, identities, data, trust boundaries, dependencies, expected behavior, and credible failure or abuse cases.
Translate those observations into preventive, detective, responsive, and recovery controls. A mature explanation states not only what the concept is, but also how a practitioner demonstrates that it is working under normal, abnormal, and recovery conditions.
Evidence of effective implementation
- Documented ownership, scope, decision criteria, and permitted exceptions.
- Configuration or architectural evidence tied to a clear control objective.
- Operational telemetry showing expected and unexpected behavior.
- Testing that covers normal use, abuse cases, failure, rollback, and recovery.
- Exceptions that are approved, time bounded, monitored, and revisited.
- Lessons learned that result in updated designs, procedures, detections, or training.
Questions for learners
- Which security properties and business outcomes does Multifactor Authentication support?
- What assumptions must remain true for the control or process to work safely?
- What could an attacker, insider, failure, or design error do at each trust boundary?
- Which evidence would prove that controls work continuously rather than only on paper?
- How would the organization respond, restore service, and re-establish trust after failure?
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: