Authentication Fundamentals & MFA

Authentication is the process of verifying that a user is who they claim to be. It is the first line of defence in access control — if authentication fails, nothing else matters. Weak authentication undermines every other security control: no amount of fine-grained authorization, encryption, or monitoring can protect a system if an attacker can simply log in as a legitimate user.

The authentication landscape has changed dramatically in the last decade. The industry is moving from knowledge-based (password) authentication toward possession-based and biometric methods, driven by the recognition that passwords are fundamentally broken as a primary authentication mechanism.

Authentication Factors

Authentication factors fall into three categories, often remembered as “something you have, know, or are”. True multi-factor authentication requires factors from at least two different categories.

Single-Factor vs. Multi-Factor

• Single-factor authentication (1FA) — Uses one factor (typically a password). Compromised if the single factor is stolen or guessed.
• Two-factor authentication (2FA) — Uses two factors from different categories (e.g., password + TOTP code). Requires the attacker to compromise both channels.
• Multi-factor authentication (MFA) — Uses two or more factors from different categories. MFA and 2FA are often used interchangeably, but strictly MFA can include more than two factors.

Password Authentication — The Current Reality

Despite decades of advancement in authentication technology, passwords remain the most common authentication method — and the most vulnerable. The challenge is that passwords are both economically and practically difficult to replace at scale.

Password Policy Best Practices — Modern Approach (NIST SP 800-63B)

How Attackers Compromise Passwords

Multi-Factor Authentication (MFA)

MFA significantly reduces the risk of account compromise. According to Microsoft, MFA blocks 99.9% of automated attacks. Organisations with MFA enforcement experience 99% fewer account compromises than those without.

MFA Methods Compared in Depth

MFA Deployment Architecture

User
 │
 ├── Primary Auth (Password + TOTP)
 │      │
 │      └── IdP verifies credentials → Issues session token
 │
 └── Step-up Auth (FIDO2 hardware key)
        │
        └── IdP challenges for high-risk action → Issues elevated token

Primary MFA — Required at every login for every user. Typically TOTP or push notification. Step-up MFA — Additional factor required for high-risk actions (admin console access, password change, large data export) even if the user already has an active session.

MFA Bypass Attack Vectors

Even MFA is not invulnerable. Understanding bypass techniques is essential for IAM professionals:

Passwordless Authentication

Passwordless authentication eliminates passwords entirely, replacing them with cryptographic key pairs. The goal is to remove both the usability burden and the security risk of passwords.

FIDO2 / WebAuthn — The Passwordless Standard

FIDO2 is the set of specifications developed by the FIDO Alliance that enables passwordless, phishing-resistant authentication. It includes the WebAuthn standard (W3C) and the CTAP protocol (for external authenticators).

Passwordless Deployment Considerations

Risk-Based Authentication (Adaptive Authentication)

Risk-based authentication (RBA) evaluates the risk level of each authentication attempt and adjusts the required authentication strength accordingly:

Low risk → Passwordless or password + device trust (seamless experience) Medium risk → Standard MFA (TOTP or push) High risk → Step-up MFA with FIDO2 hardware key + justification required

Authentication Protocol Comparison

Key Takeaways

• Authentication factors must come from different categories (knowledge, possession, inherence) for true MFA — using two factors from the same category is not MFA
• Password policies should prioritise length (12+ characters) and MFA enablement over complexity rules and periodic rotation per NIST SP 800-63B
• MFA blocks 99.9% of automated attacks — it is the single most impactful security control an organisation can deploy
• MFA is not invulnerable — understand bypass vectors (MFA fatigue, SIM swap, session token theft, Adversary-in-the-Middle)
• FIDO2/WebAuthn provides phishing-resistant, passwordless authentication using public-key cryptography — the private key is bound to the origin domain and never leaves the user’s device
• Risk-based authentication adjusts auth requirements based on contextual risk factors (device, location, time, behaviour) to balance security and user experience
• The industry is moving toward passwordless as the long-term authentication goal, with FIDO2 as the leading standard