What is multi-factor authentication?
Multi-factor authentication means that a user proves who they are in more than one way, for example with a password and a code from an app on their phone.
The factors are usually grouped into something the user knows, such as a password, something they have, such as a phone or a security key, and something they are, such as a fingerprint. It is often called two-step verification.
A stolen password is then not enough to get in. The attacker also needs the second factor, which makes the simplest attacks on accounts considerably harder.
Recovery codes usually come with it. They are used if the phone or key is lost, and need to be stored as carefully as the password.
How it works
After the password, the system asks for a second proof. It can be a code from an app, a confirmation in an app or a security key plugged into the computer. The code in an app changes at regular intervals and can be used only once.
Security keys and methods tied to the site the user is signing in to are the hardest to fool. A code the user types in can, at worst, be captured by a fake sign-in page.
Why it matters
A password can leak in many ways, through phishing, reuse or a breach at another service. The second factor means the password alone is not enough, and that also protects the AI tools that reach the organisation's documents.
What to keep in mind
Think about how users get help when they change phones or lose their key. A weak recovery routine can become the route an attacker chooses.
Combine it with single sign-on, so the same requirement applies in every connected system and access control rests on a well-protected account.
What it means for you
Require multi-factor authentication for everyone who reaches sensitive information, and administrators in particular. With single sign-on the requirement can be set in one place.
Common questions
Are text message codes secure enough?
They are better than a password alone. An app or a security key gives stronger protection, because text messages can be intercepted or redirected.
Does everyone need multi-factor authentication?
It is a good starting point for everyone who reaches internal systems. The most important group is those with administrator rights. Read more about single sign-on.
Sources: NIST on multi-factor authentication
Related terms
Read more
All terms Updated