Multi-factor authentication (MFA) in plain English
When you sign in to a computer or an online service, you prove that you really are who you say you are. Experts call this authentication. Usually, a password is all it takes. The problem: passwords can be guessed, intercepted, or found in data breaches.
With multi-factor authentication, you combine at least two different types of proof, known as factors. They come from three categories: something you know (a password or PIN), something you have (a smartphone or security key), and something you are (a fingerprint or your face).
You already know the principle from using an ATM: you need both your card and your PIN. Someone who only knows your PIN can’t get to your money – and neither can someone who only finds your card. When exactly two factors are used, this is also called two-factor authentication (2FA).
How MFA works
After you enter your password, the system asks for a second form of proof. The common methods differ significantly in how secure they are:
- SMS code: A one-time code arrives by text message. This is better than a password alone, but it’s the weakest option, because text messages can be redirected or intercepted.
- Authenticator app: An app on your smartphone continuously generates new one-time codes that are valid only for a short time.
- Push notification: The app asks, “Are you trying to sign in?” and you tap “Yes.” This is convenient but vulnerable to “MFA fatigue”: attackers who have stolen a password trigger request after request until someone, worn down, approves one. The remedy is number matching, where you enter a number shown on the login screen into the app.
- Security keys and passkeys (FIDO2): The login is confirmed by a small security key that you plug in via USB or hold to your smartphone, or by a passkey – a digital key stored on your smartphone or computer or in a password manager. Both rely on cryptographic keys based on the FIDO2 standard. They are considered phishing-resistant because they only work on the genuine website – not on a fake.
What matters most is that MFA is enforced everywhere, with no gaps. Attackers deliberately look for access points that are exempt: legacy email protocols without MFA support, poorly protected emergency accounts, or accounts that were exempted “just temporarily.”
A practical example
A retail company secures its employees’ remote access with MFA – using simple push notifications in an app. One evening, an employee receives sign-in requests on his smartphone every minute. He assumes it’s a glitch and eventually taps “Approve” just to make it stop. An attacker who had previously stolen his password through phishing is now inside the corporate network.
The follow-up investigation also reveals that an old shared mailbox – an address used jointly by the accounting team – was completely exempt from the MFA requirement. The company switches remote access to number matching, issues FIDO2 keys for its administrator accounts, and closes all exceptions. A simple rule now applies as well: if you didn’t trigger a request yourself, reject it and report it.
Why does this matter for businesses?
Stolen or guessed passwords are a classic entry point. Attackers steal them with fake emails (phishing), try common passwords on many accounts (password spraying), or test credentials leaked in data breaches elsewhere (credential stuffing). MFA makes all of these attacks much harder. It’s especially important for everything that can be reached from the internet: email, cloud services, VPN, and remote maintenance access.
Regulations address the issue as well: the NIS2 Directive and the German BSI Act (BSIG) – the law governing Germany’s Federal Office for Information Security – explicitly list multi-factor authentication among the risk management measures for companies in scope. Cyber insurers also often ask about it when you take out a policy.
That said, MFA is no silver bullet. Fake login pages known as phishing proxies slip unnoticed between users and the real service. They capture one-time codes and take over the signed-in session – a form of man-in-the-middle attack. That’s why switching to phishing-resistant methods pays off.
How to protect your organization
- No exceptions: Enable MFA for all access from the internet – including for service providers and shared mailboxes.
- Choose strong methods: Rely on FIDO2 security keys or passkeys – or at least on authenticator apps with number matching instead of SMS.
- Give administrator accounts extra protection: Accounts with far-reaching privileges should use phishing-resistant methods exclusively.
- Close legacy sign-in paths: Protocols that don’t support MFA should be disabled.
- Plan for emergencies: Set up secured emergency accounts and a clear procedure for when a smartphone is lost.
- Raise team awareness: Unexpected MFA requests are a warning sign – they likely mean someone already knows the password.
How Rootsektor can help
With our Microsoft 365 & Azure Review, we check whether MFA is really enforced everywhere in your Microsoft cloud: which methods are allowed, whether legacy sign-in paths are still open, and whether your Conditional Access policies contain unintended exceptions. These policies determine who may sign in under which conditions. You receive prioritized remediation recommendations. Submit your request via our Pentest Quote page; after scoping, you’ll receive a fixed-price quote within 24 hours (on business days).