Kishin's Blog
← Back to all posts
8 min readKishin

Multi-Factor Authentication: Choosing the Right Solution for Your Organization

SecurityAuthentication

Passwords alone are no longer sufficient to protect organizational assets. Credential stuffing, phishing, brute-force attacks, and password reuse have made single-factor authentication a liability rather than a safeguard. Multi-factor authentication (MFA) adds additional layers of verification that dramatically reduce the risk of unauthorized access, but not all MFA solutions are created equal.

Selecting the right MFA implementation requires understanding the different factor types, evaluating their security properties, and balancing security with user experience. This guide covers everything you need to make that decision.

The Three Authentication Factors

MFA works by requiring users to present evidence from two or more of the following categories:

  • Something you know: Passwords, PINs, security questions. These are the weakest factor because they can be guessed, phished, or stolen in breaches.
  • Something you have: Physical devices such as phones, hardware tokens, or smart cards. These are stronger because an attacker needs physical possession of the device.
  • Something you are: Biometric characteristics such as fingerprints, facial recognition, or voice patterns. These are unique to the individual but can be compromised if the biometric template is stolen.

True MFA requires factors from at least two different categories. A password plus a PIN is not MFA (both are knowledge factors. A password plus an authenticator app code is MFA) one knowledge factor and one possession factor.

Comparing MFA Methods

SMS One-Time Passwords (OTP)

SMS OTP was once the default MFA method due to its simplicity: nearly every user has a phone that can receive text messages. However, it is now considered the least secure option and should be avoided for protecting sensitive systems.

  • SIM swapping: Attackers convince or bribe mobile carrier employees to transfer the victim's phone number to a SIM card they control. With the number ported, they receive all SMS messages, including OTP codes. This attack has been used to steal millions in cryptocurrency and compromise executive accounts.
  • SS7 vulnerabilities: The Signaling System 7 protocol that routes SMS messages has known vulnerabilities that allow attackers to intercept messages without physical access to the phone.
  • Phishing vulnerability: SMS OTP provides no protection against real-time phishing attacks. A proxy tool can capture the OTP and replay it to the legitimate service.

Verdict: Acceptable only for low-risk applications where no better option is available. Never use for protecting financial systems, administrative access, or sensitive data.

Authenticator Apps (TOTP)

Time-based One-Time Password (TOTP) apps like Google Authenticator, Authy, and Microsoft Authenticator generate rotating codes that change every 30 seconds. They are a significant improvement over SMS because the codes are generated locally on the device and are never transmitted over a network.

  • Strengths: No network dependency, resistant to SIM swapping and SS7 attacks, widely supported across services.
  • Weaknesses: Still vulnerable to real-time phishing proxies. An attacker can trick a user into entering their current TOTP code on a fake login page, then immediately use it on the real service within the 30-second window.
  • Seed protection: The TOTP shared secret must be stored securely on the device. If an attacker gains access to the device or its backups, they can generate codes independently.

Verdict: A solid baseline for most organizations. Better than SMS, but not phishing-resistant.

Push Notifications

Push-based MFA sends a notification to the user's registered mobile device, asking them to approve or deny the login attempt. Solutions like Duo Security and Microsoft Authenticator offer push notifications with additional context such as the login location, device, and application.

  • Strengths: Excellent user experience: users simply tap "Approve" rather than typing a code. Contextual information helps users identify suspicious login attempts.
  • Weaknesses: Vulnerable to MFA fatigue attacks, where attackers send repeated push notifications until the user approves one out of frustration or habit.

Verdict: Good user experience with number matching or contextual verification. Requires MFA fatigue mitigations to be effective.

Hardware Security Keys

Hardware security keys like YubiKey, Google Titan, and SoloKeys represent the gold standard for MFA security. They implement the FIDO2/WebAuthn standard, which provides phishing-resistant, cryptographic authentication.

  • Phishing resistance: FIDO2 authentication is bound to the origin (domain) of the website. If a user is on a phishing site, the key will refuse to authenticate because the origin does not match. This makes real-time phishing proxies completely ineffective.
  • No shared secrets: The private key never leaves the hardware device. There is no shared secret that can be stolen from a server breach.
  • Physical presence: Authentication requires the user to physically touch or tap the key, providing strong proof of presence.
  • Resistant to malware: Even if the user's computer is compromised with malware, the authentication flow cannot be replayed or intercepted.

Weaknesses: Cost per user, logistical challenges of distributing and managing physical keys, and the risk of users losing keys. Backup key enrollment is essential.

Verdict: The strongest available option. Required for high-value targets: administrators, developers with production access, executives, and anyone with access to sensitive data.

Passkeys and Biometrics

Passkeys are the evolution of FIDO2 authentication, stored on devices like phones and laptops and unlocked with biometrics (fingerprint, face) or device PIN. They combine the phishing resistance of hardware keys with the convenience of biometric unlock.

  • Cross-device sync: Passkeys can sync across devices via platform ecosystems (iCloud Keychain, Google Password Manager, Windows Hello), making them more practical than hardware keys for everyday users.
  • Phishing resistant: Like hardware keys, passkeys are bound to the origin and cannot be intercepted by phishing proxies.
  • No passwords: Passkeys can replace passwords entirely, eliminating the weakest factor from the equation.

Verdict: The future of authentication. Increasingly supported by major platforms and services. Organizations should begin planning passkey adoption as part of their authentication roadmap.

Phishing-Resistant MFA

The critical distinction in modern MFA is phishing resistance. Traditional MFA methods (SMS, TOTP, push) can all be defeated by real-time phishing attacks using tools like Evilginx2, Modlishka, and EvilProxy. These tools act as reverse proxies, sitting between the user and the real login page, capturing credentials and MFA tokens in real time.

Only FIDO2/WebAuthn-based authentication (hardware keys and passkeys) provides true phishing resistance because the cryptographic challenge is bound to the website's origin. The NIST Cybersecurity Framework now explicitly recommends phishing-resistant MFA for high-value accounts.

Organizations that handle sensitive data (healthcare, financial services, government, critical infrastructure) should prioritize phishing-resistant MFA as a baseline requirement.

NIST Guidelines on MFA

The National Institute of Standards and Technology (NIST) Special Publication 800-63B provides authoritative guidance on digital identity and authentication. Key points include:

  • SMS-based OTP is classified as a "restricted" authenticator due to known vulnerabilities.
  • Biometrics should be used as a factor in combination with another factor, not as a standalone authenticator.
  • Verifiers must implement rate limiting and account lockout to prevent brute-force attacks on MFA codes.
  • Authenticators should support at least 6-digit codes or equivalent entropy.
  • Re-authentication should be required after extended periods of inactivity.
  • Passwordless authentication using FIDO2 is recommended where feasible.

Deployment Strategies

Rolling out MFA across an organization requires careful planning to minimize disruption and maximize adoption.

  • Phased rollout: Start with high-risk groups (administrators, developers, executives) before extending to the broader organization. This allows you to refine the process and address issues at smaller scale.
  • Multiple factor options: Offer a choice of MFA methods to accommodate different user preferences and device capabilities. Not every user can use a hardware key, and not every user has a smartphone.
  • Self-service enrollment: Provide a self-service portal for users to register their MFA devices, reducing helpdesk burden.
  • Backup methods: Always require users to enroll at least two factors or devices. A user who loses their sole MFA device is locked out, generating a helpdesk call and creating pressure to bypass security controls.
  • Gradual enforcement: Allow a grace period where MFA is optional before making it mandatory. Communicate the timeline clearly and provide support resources.

MFA Fatigue Attacks and How to Prevent Them

MFA fatigue attacks exploit push notification MFA by bombarding users with authentication requests until they approve one out of frustration. The 2022 Uber breach was executed using this technique: the attacker obtained the target's password through social engineering, then sent repeated MFA push notifications until the victim approved.

Prevention measures:

  • Number matching: Require users to enter a number displayed on the login screen into their authenticator app, rather than simply tapping "Approve." This ensures the user is actively engaged with the authentication request.
  • Geographic context: Display the login location and IP address in the push notification so users can identify obviously suspicious requests.
  • Push throttling: Limit the number of push notifications that can be sent within a time window. If a user denies a request, do not allow another push for that account for a cooldown period.
  • User education: Train users that repeated, unexpected MFA prompts are a sign of an active attack and should be reported immediately.

Conditional Access Policies

Modern identity platforms support conditional access policies that dynamically adjust authentication requirements based on risk signals.

  • Location-based: Require MFA for logins from outside the corporate network, but allow passwordless authentication from managed devices on-premises.
  • Device-based: Require stronger MFA factors when the device is unmanaged or non-compliant with security policies.
  • Risk-based: Trigger step-up authentication when anomalous behavior is detected: impossible travel, login from a new device, or access to high-risk applications.
  • Application sensitivity: Apply different MFA requirements based on the sensitivity of the application being accessed. Email may require TOTP, while production infrastructure requires a hardware key.

Decision Framework

Use this framework to select the right MFA solution for your organization:

  • High security (administrators, developers, executives): Hardware security keys (FIDO2) as primary factor, with biometric passkeys as backup. Number-matching push as a last resort.
  • Standard employees: Passkeys or authenticator app with number-matching push. SMS should not be an option.
  • External partners and customers: TOTP authenticator app or passkeys, with SMS only as a fallback for users without smartphones.
  • API and service accounts: Client certificate authentication or OAuth 2.0 client credentials with short-lived tokens. No interactive MFA.

Most of the MFA reviews I do end up being less about which factor to pick and more about the gaps: the break-glass account nobody rotated, the legacy app that got a policy exception two years ago and was never revisited. Start there before arguing about FIDO2 versus push notifications.