Lessons · Cybersecurity · multi-factor authentication
Proving it is really you, twice
Multi-factor authentication asks for two different kinds of proof, something you know and something you have, so a stolen password on its own is not enough to get in.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by a practising security analyst. Practice material, not professional advice. What that means.
What it is for
The password was in a breach dump three years old. Somebody in another country typed it in at 4 a.m. and the login stopped at the prompt for the six-digit code on a phone that was on a bedside table. That is the story of most of the account takeovers that never happened.
How to think about it
MFA stops everything that only has the password: stuffing, guessing, a password read off a note. It does not stop somebody being talked into approving a prompt. Put it on the internet-facing systems first, and on administrator accounts before anything else.
Worked example
Factor 1: something you know, the passwordCan be copied without you ever noticing.
Factor 2: something you have, an app code or a hardware keyHas to be physically present, and a stolen list does not include it.
Rollout order: administrators, then email, then remote access, then everybodyHighest value first. Administrator accounts are the keys to every other lock.
What it does not stop: a user approving a prompt they did not startSo the rule is: a prompt you did not cause is a report, not an approval.
Your turn
An app code or a hardware key is a factor of which kind? Finish the phrase.
something you
Solve one, graded on the server
The trap
Counting a password and a security question as two factors. Both are things you know, and both are usually in the same breach dump.