What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) is a security method that requires users to provide two or more different types of authentication factors before accessing an account, application, or system.

Instead of relying only on a password, MFA requires additional evidence that a user is who they claim to be. This could include a one-time code from an authenticator app, a physical security key, or a biometric factor such as a fingerprint.

MFA strengthens account security because stealing a password alone may not be enough for an attacker to gain access. It is an important component of identity and access management (IAM), Zero Trust security, and a layered cybersecurity strategy.

Key Takeaways

• Multi-factor authentication (MFA) adds an extra layer of security by requiring users to verify their identity using two or more different authentication factors, such as passwords, security keys, or biometrics.
• MFA helps prevent unauthorized access and credential-based attacks. Even if attackers steal a password, additional authentication requirements can make it harder to compromise an account.
• Not all MFA methods offer the same level of protection. Phishing-resistant MFA provides stronger security against credential theft, while traditional methods can be vulnerable to MFA fatigue, social engineering, and session hijacking.
• MFA alone cannot prevent lateral movement or contain security breaches. Organizations should combine MFA with Zero Trust principles, least-privilege access, and segmentation to limit attackers' ability to move between systems after a compromise.

How does multi-factor authentication work?

Multi-factor authentication verifies a user's identity using multiple independent authentication factors.

A typical MFA process works like this:

1. A user attempts to sign in to an account or application.
2. The user provides a first authentication factor, such as a password.
3. The system requests an additional factor.
4. The user verifies their identity using a different type of factor, such as an authenticator app or security key.
5. The system validates both factors.
6. If the authentication requirements are met, the user is granted access.

The key to MFA is that the authentication methods come from different factor categories. Requiring two passwords, for example, would not generally constitute multi-factor authentication because both are the same type of factor.

What are the types of authentication factors?

Authentication factors are generally grouped into several categories based on how a user proves their identity.

Something you know

A knowledge factor is information the user knows.

Examples include:

• Kennwörter
• PINs
• Passphrases

Passwords are widely used but can be stolen through phishing, credential stuffing, malware, and other cyberattacks.

Something you have

A possession factor is something the user physically possesses.

Examples include:

• Smartphones
• Authenticator applications
• Hardware security keys
• Smart cards
• Hardware tokens

An attacker who steals a user's password would also need access to the possession factor to satisfy the authentication requirements.

Something you are

An inherence factor uses a physical or behavioral characteristic associated with the user.

Examples can include:

• Fingerprints
• Facial recognition
• Iris scans
• Other biometric identifiers

Biometrics can provide convenient authentication, but organizations must carefully protect biometric information because it cannot be changed as easily as a password if compromised.

Why is multi-factor authentication important?

MFA reduces the risk that compromised passwords will immediately result in unauthorized access.

Passwords can be exposed through phishing, data breaches, credential stuffing, password reuse, malware, and brute-force attacks. If an account relies only on a username and password, obtaining those credentials may be enough for an attacker to sign in.

MFA creates an additional barrier.

Even if an attacker obtains the correct password, they must also satisfy another authentication requirement before gaining access.

Organizations use MFA to help:

• Protect employee and customer accounts
• Reduce credential-based attacks
• Secure remote access
• Protect cloud applications
• Strengthen privileged accounts
• Support Zero Trust initiatives
• Reduce unauthorized access to sensitive resources
• Meet security and compliance requirements

What is the difference between MFA and 2FA?

Two-factor authentication (2FA) is a type of multi-factor authentication.

MFA requires two or more different authentication factors. 2FA specifically requires two.

For example, entering a password and then approving the login using a hardware security key is 2FA because it combines something the user knows with something the user has.

An authentication process requiring three different factors would still be MFA, but it would not be described as two-factor authentication.

In practice, the terms MFA and 2FA are sometimes used interchangeably, but MFA is the broader category.

What are common MFA methods?

Organizations can implement MFA in several ways depending on their security requirements and technology.

Common MFA methods include:

• Authenticator apps that generate one-time passcodes
• Push notifications sent to trusted devices
• Hardware security keys
• Smart cards
• SMS or text message codes
• Email verification codes
• Biometric authentication
• One-time passwords (OTPs)

Not all MFA methods provide the same level of protection.

For example, SMS-based authentication can provide additional protection compared with password-only authentication, but it can be vulnerable to techniques such as SIM swapping and phishing.

Organizations protecting sensitive systems may choose stronger, phishing-resistant authentication methods.

What is phishing-resistant MFA?

Phishing-resistant MFA is designed to prevent attackers from stealing or replaying authentication credentials through phishing attacks.

Some traditional MFA methods rely on codes or approval prompts that users can accidentally provide to an attacker. Phishing-resistant methods use cryptographic authentication designed to bind the authentication process to the legitimate service.

Hardware security keys and technologies based on FIDO standards are common examples.

Phishing-resistant MFA can provide stronger protection for high-value accounts, administrators, and users who have access to sensitive systems.

What is MFA fatigue?

MFA fatigue, sometimes called MFA bombing or push bombing, is an attack in which a threat actor repeatedly sends authentication requests to a user's device.

The attacker typically already has the victim's username and password. They trigger repeated MFA prompts hoping the user will eventually approve one accidentally, out of confusion, or simply to stop the notifications.

MFA fatigue demonstrates why simply enabling MFA is not enough. Organizations should consider stronger authentication methods, monitor unusual authentication behavior, educate users, and limit excessive or suspicious authentication attempts.

Can MFA be hacked or bypassed?

MFA significantly strengthens authentication, but it is not impossible to bypass.

Attackers may attempt to defeat MFA using techniques such as:

• Phishing
• Adversary-in-the-middle attacks
• Session token theft
• MFA fatigue
• SIM swapping
• Malware
• Social engineering
• Account recovery abuse
• Compromised endpoints

For example, an attacker may trick a user into authenticating through a malicious phishing site and then steal the resulting session token.

MFA should therefore be one part of a layered security strategy rather than the only control protecting sensitive resources.

What is the difference between MFA and single sign-on?

Multi-factor authentication and single sign-on (SSO) solve different identity and access problems.

MFA strengthens authentication by requiring multiple types of evidence before granting access.

SSO allows users to authenticate once and then access multiple connected applications without repeatedly entering credentials.

Organizations often use MFA and SSO together. A user can complete MFA during the initial SSO authentication process and then access authorized applications through the established identity session.

What is the difference between MFA and passwordless authentication?

MFA and passwordless authentication are related but different concepts.

MFA requires multiple authentication factors. Passwordless authentication allows a user to authenticate without entering a traditional password.

For example, a system could authenticate a user using a hardware security key and biometric verification rather than a password.

Passwordless authentication can reduce risks associated with stolen, reused, or weak passwords. Depending on its implementation, passwordless authentication may also use multiple factors.

How does MFA support Zero Trust security?

MFA is an important part of a Zero Trust security strategy because Zero Trust requires organizations to verify users and devices rather than automatically trusting them based on network location.

MFA provides stronger evidence that a user requesting access is the legitimate account owner.

However, Zero Trust does not end once a user successfully authenticates.

After authentication, organizations should still limit access based on least privilege and control which applications, workloads, and resources can communicate. A legitimate account can be compromised, and an authenticated user should not automatically receive unrestricted access throughout the environment.

Combining MFA with least-privilege access, continuous monitoring, and segmentation creates multiple layers of defense.

Can MFA prevent lateral movement?

MFA can make it harder for attackers to compromise accounts, but it cannot prevent all lateral movement.

If an attacker bypasses MFA, steals an authenticated session, compromises a workload, or gains access through another vulnerability, they may already be inside the environment.

The attacker can then attempt to discover additional systems and move from one resource to another.

This is why organizations need controls that assume breaches can still occur. Segmentation limits communication between systems so that gaining access to one resource does not automatically provide a pathway to everything else.

MFA helps protect the initial access point. Segmentation helps contain an attacker if that access point is compromised.

How Illumio complements multi-factor authentication

Multi-factor authentication strengthens identity security by making it more difficult for attackers to gain access using stolen credentials. Illumio provides an additional layer of protection by limiting what attackers can reach if authentication controls are bypassed.

Illumio provides visibility into communication between workloads, applications, and resources across hybrid and multi-cloud environments.

With Illumio Segmentation, organizations can enforce least-privilege communication and restrict unnecessary connections between systems.

If an attacker compromises an authenticated account or gains access to a workload, segmentation helps contain the breach by limiting available pathways for lateral movement.

Together, MFA and segmentation support a defense-in-depth approach: MFA makes unauthorized access more difficult, while segmentation limits the impact of a successful compromise.

Go Beyond Authentication With Illumio Segmentation

Multi-factor authentication helps keep unauthorized users out, but what happens when attackers bypass authentication or compromise a legitimate account? Once inside, attackers may attempt to move laterally across your environment to reach sensitive data and critical systems.

Illumio Segmentation adds another layer of protection by limiting unnecessary communication between workloads and applications, reducing the pathways attackers can exploit after gaining access.

Strengthen your Zero Trust strategy and stop attackers from spreading.‍

Explore Illumio Segmentation →

Häufig gestellte Fragen

What does MFA stand for?

MFA stands for multi-factor authentication. It is an authentication method that requires two or more different types of verification before granting access to an account, application, or system.

What is an example of multi-factor authentication?

An example of MFA is signing in with a password and then using a hardware security key to complete authentication. The password is something you know, while the security key is something you have.

Is MFA the same as 2FA?

Not exactly. Two-factor authentication (2FA) is a type of MFA that requires exactly two authentication factors. MFA is the broader term and can require two or more factors.

Is a password and PIN considered MFA?

Generally, no. A password and PIN are both knowledge factors, or something you know. MFA requires authentication methods from different factor categories.

Is MFA better than a password?

MFA generally provides stronger protection than password-only authentication because compromising the password alone may not be enough to access the account. The strength of MFA still depends on the authentication methods used and how they are implemented.

What is the strongest type of MFA?

Phishing-resistant MFA methods, such as authentication using FIDO-based hardware security keys or passkeys, can provide stronger protection against phishing than methods based on manually entered one-time codes or SMS messages.

Can hackers bypass MFA?

Yes. Attackers can sometimes bypass MFA using phishing, session token theft, MFA fatigue, social engineering, malware, or other techniques. MFA significantly strengthens authentication but should be combined with additional security controls.

Does MFA prevent phishing?

MFA can reduce the likelihood that credentials stolen through phishing will result in account compromise, but not every MFA method prevents phishing. Phishing-resistant authentication methods provide stronger protection against attacks designed to steal or relay credentials.

Why is MFA important for Zero Trust?

MFA strengthens identity verification, which supports the Zero Trust principle of explicitly verifying access. Zero Trust also requires organizations to limit access and communication after authentication using least privilege and other security controls.

‍