Cyber Security Multi-Factor Authentication

Multi-factor authentication requires proving your identity with two or more independent factors — something you know, something you have, and something you are — so a single stolen credential isn't enough to break in.

The Three Classic Factors

  • Knowledge — something you know, like a password or a PIN.
  • Possession — something you have, like your phone, a hardware security key, or a smart card.
  • Inherence — something you are, like a fingerprint, face, or iris (biometrics).

Genuine MFA means combining factors from different categories, not just piling up more of the same type. Requiring two different passwords is still only one factor (knowledge) repeated twice, and offers little of the protection real MFA provides — an attacker who already stole one password through phishing or a breach has a good chance of having (or guessing) the other one too.

How a Typical MFA Login Looks

  1. Enter a username and password (the knowledge factor).
  2. Provide a one-time code from an authenticator app, or approve a push notification sent to your registered phone (the possession factor).
  3. Access is only granted once both checks pass.
MethodHow it worksRelative strength
SMS one-time codeA code is texted to your phone numberWeakest — vulnerable to SIM-swapping
Authenticator app (TOTP)App generates a time-based code locally on the deviceStronger — doesn't rely on the phone network
Push notification approvalYou tap 'approve' or 'deny' on your phoneConvenient, but vulnerable to push-bombing if not paired with number matching
Hardware security key (FIDO2/U2F)A physical key you plug in or tapStrongest — resistant to phishing and remote interception

Why SMS Codes Are the Weakest Link

SMS-based codes depend on your phone number, and phone numbers can be hijacked through SIM-swapping, where an attacker convinces (or bribes, or social-engineers) your mobile carrier into moving your number onto a SIM card they control. Once that happens, any SMS codes meant for you go straight to the attacker instead. Authenticator apps and hardware security keys don't rely on the cellular network at all, which removes this particular attack path entirely.

A Second Factor Isn't a Magic Shield

MFA fatigue, sometimes called push-bombing, is a real attack pattern: an attacker who already has a valid password triggers repeated push-approval prompts on the victim's phone, hoping they'll eventually tap 'approve' out of confusion, annoyance, or habit. Systems that use number-matching (where the user must enter a code shown on the login screen into their phone, rather than tapping a single approve button) are far more resistant to this, since it requires the user to actually be looking at the real login attempt.

Note: Never approve an MFA push notification you did not personally just trigger, even if it seems harmless or you assume it will 'go away' — repeated unexpected prompts are a strong sign someone else already has your password.
Note: Where the option exists, prefer an authenticator app or a hardware security key over SMS codes, and prioritize enabling MFA on your email account first, since email is usually the recovery path attackers can use to reset access to everything else.

Keep Going

Cyber Security Interview QuestionsPractice real questions asked for Cyber SecurityCybersecurity Analyst SalarySee what Cybersecurity Analyst roles pay in the marketAuto Apply for JobsApply to open roles related to Cyber Security and tweak your resume