Cyber Snapshot - MFA

Overview

Multi-Factor Authentication (MFA) and Two-Factor Authentication (2FA) are recommended security features that, once enabled, provide an added layer of protection for the user or account holder. With the current threat landscape, passwords alone are no longer sufficient to secure user accounts, especially weak passwords that are less than 16 characters in length.

There are three categories of MFA:

• Something you know: This includes passwords, Personal Identification Numbers (PINs) or answers to security questions.
• Something you have: This refers to a physical item, such as a smartphone with an authenticator app, a hardware security key, or a code sent via text message.
• Something you are: This category includes biometrics like fingerprints, facial recognition, or voice scans. 

As cyber threats continue to evolve, many organizations are moving away from relying solely on passwords, since they are easily compromised. Implementing MFA/2FA adds a critical layer of protection, ensuring that even if one factor of authentication is exposed, unauthorized access remains highly unlikely. However, not all MFA/2FA methods are created equal. The MC3 recommends prioritizing authenticator applications over push notifications, as push notifications sent to an email address are vulnerable to interception due to compromised accounts.

Types of MFA/2FA Technologies

Biometric authentication

Biometric technologies are a form of authentication that accurately and securely validate users through their devices. The most common biometric modalities are fingerprint scans and face recognition. Biometric authentication also includes behavioral biometrics, which provide an invisible layer of security by continuously authenticating an individual based on the unique ways they interact with their computer or mobile device such as keystrokes, swipe patterns, mouse movements, and more.

Hardware tokens

Hardware authenticators are small, easy-to-use devices that an owner carries to authorize access to a network service. By supporting strong authentication with one-time passcodes (OTPs), the physical tokens provide a possession factor for MFA while enabling 
enhanced security.

Mobile authentication

Mobile authentication is the process of verifying a user via their Android or iOS device or verifying the device itself. This technology allows users to login to secure locations and access resources from anywhere with enhanced security.

Out-of-band authentication

This authentication type requires a secondary verification method through a separate communication channel, typically the person’s Internet connection and the wireless network on which their mobile phone operates.

Push notification

Push notifications deliver an authentication code or one-time passcode on the user’s mobile device. Unlike Short Message Service (SMS) messages, the notification appears on the device’s lock screen.

SMS text message or voice message

One-time passcodes are delivered to the user’s mobile device through either an SMS text message or a voice message.

Soft token

Software authenticators, also known as app-based tokens, generate a one-time PIN. These software tokens are often used in MFA scenarios where the user’s device, such as a smartphone, serves as the possession factor.

Conclusion

Multi-Factor Authentication (MFA) strengthens account security by requiring users to verify their identity through at least two different methods. Even if a password is compromised, MFA adds an extra layer of protection that makes it much more difficult for cybercriminals to access sensitive information, helping defend against threats such as data breaches and credential theft.

References

SPECOPS Software - NIST MFA Guidelines Explained

NIST Computer Security Resource Center - Multi-Factor Authentication

November 21, 2025
CS-06-2025