Course contents

Chapter 12: Security FundamentalsLesson 12 of 18

Multi-factor authentication

Knowledge, possession and inherence factors, TOTP, push, hardware keys and where MFA fits with AAA.

Beginner · 8 min read

Technical definition

Multi-factor authentication (MFA) requires two or more different kinds of proof before granting access, such as a password plus a code from a phone. A stolen password alone is no longer enough.

The factors

Authentication factors
Authentication factorsFactor; Meaning; Examples. Knowledge: Something you know Password, PIN, security answers Possession: Something you have Phone with an authenticator app, hardware key, smart card Inherence: Something you are Fingerprint, face, iris Location or time (sometimes listed): Somewhere you are or when Corporate network, expected countryFactorMeaningExamplesKnowledgeSomething you knowPassword, PIN, security answersPossessionSomething you havePhone with an authenticator app,hardware key, smart cardInherenceSomething you areFingerprint, face, irisLocation or time(sometimes listed)Somewhere you are or whenCorporate network, expected country

On small screens, swipe sideways or focus the diagram and use the arrow keys.

MFA needs factors from at least two different rows. Two knowledge factors do not count.

Common second factors compared

Strengths of each method
Strengths of each methodMethod; How it works; Weakness. SMS code: A one-time code sent by text SIM swapping, interception, phishing TOTP app: Time-based code from an app, valid about 30 seconds Can still be phished in real time Push approval: Approve a prompt on a phone Fatigue attacks: repeated prompts until a user taps accept FIDO2 / hardware key: A key proves possession and checks the site's real address Cost; must keep a backup key Biometrics: Fingerprint or face on the device Cannot be changed if copied; usually unlocks a local keyMethodHow it worksWeaknessSMS codeA one-time code sent by textSIM swapping, interception, phishingTOTP appTime-based code from an app, validabout 30 secondsCan still be phished in real timePush approvalApprove a prompt on a phoneFatigue attacks: repeated promptsuntil a user taps acceptFIDO2 / hardware keyA key proves possession and checksthe site's real addressCost; must keep a backup keyBiometricsFingerprint or face on the deviceCannot be changed if copied; usuallyunlocks a local key

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Phishing-resistant methods, such as FIDO2 keys and passkeys, are the strongest.

Where MFA fits in the network

  • VPNs and remote access: the VPN gateway asks the AAA server, which checks the second factor.
  • Device administration: TACACS+ or RADIUS with MFA protects logins to routers and switches.
  • Cloud and email: the identity provider enforces MFA for every application.

Good practice

  1. Turn MFA on for administrators first, then everyone.
  2. Prefer app codes or hardware keys over SMS.
  3. Keep recovery codes or a spare key in a safe place.
  4. Limit push prompts so users notice unexpected ones.

Test yourself

Predict · scenario 1

Which pair counts as multi-factor authentication?

Predict · scenario 2

A fingerprint is an example of which factor?

Predict · scenario 3

Which second factor resists real-time phishing best?

FAQ

Is two passwords two-factor?
No. Both are the same kind of factor, something you know. The factors must come from different categories.
Is SMS a good second factor?
It is better than nothing but the weakest common option: SIM swapping and message interception can defeat it. Authenticator apps and hardware keys are stronger.
How does MFA work with network devices?
The AAA server, such as RADIUS or TACACS+, can ask an MFA system to verify the second factor before it returns accept. The switch or router still only talks to the AAA server.