Multi-Factor Authentication (MFA)
Overview
MFA requires two or more different authentication factors, making a stolen password far less useful on its own.
Key concepts
- Common combinations: password + app/push/key/biometric
- Especially important for email, cloud, VPN, admin, and financial accounts
How it works
Multi-factor authentication (MFA) requires two or more different authentication factors, making a stolen password far less useful since the attacker would also need another factor. It's especially important for email, cloud services, VPNs, administrator accounts, financial accounts, and remote access.
Common MFA combinations
| Combination | How it works |
|---|---|
| Password + authenticator app | Password plus a temporary code from an authenticator app — common for email, cloud accounts, online services. |
| Password + push notification | Password plus approving a login request on a registered device. Review push prompts carefully to avoid approving fraudulent attempts. |
| Password + hardware security key | Password plus a physical security key — strong protection against phishing and credential theft. |
| Password + biometric | Password plus a fingerprint or face scan. |
Examples
A student signs into a school account with a password and approves a login prompt on their phone. A network administrator uses a password and a hardware security key before connecting to a VPN.