~/moritzsamrock_

Multi-Factor Authentication

Also known as:MFA

Multi-Factor Authentication: Requires at least two independent factors for identity verificationVerificationConfirmation that a requirement was met or a remediation achieved its intended result.. The term is central to identity and access controls. In practice, clear policies, loggingLoggingThe recording of security-relevant events so activity can be monitored, investigated, and audited., regular review, and the strongest possible authentication are crucial.

How it works and where it fits

Multi-Factor Authentication separates the subject, digital identity, authentication factor, and authorization decision. Authentication establishes who or what is presenting an identity; authorization then determines which action is permitted in the current context. Session state, device trust, request origin, and risk signals can further influence that decision.

Practical security relevance

Effective implementation requires a controlled identity lifecycle from creation through role and entitlement changes to suspension and removal. Strong authentication, least privilege, periodic recertification, and traceable logs are central. Controls must also identify abuse of legitimate accounts, because valid credentials alone do not prove that an action is legitimate.

  • Two-Factor AuthenticationTwo-Factor AuthenticationA special case of MFA involving exactly two independent authentication factors.: A special case of MFA involving exactly two independent authentication factors.
  • Universal Second FactorUniversal Second FactorStandard for hardware-based strong second-factor authentication.: Standard for hardware-based strong second-factor authentication.
  • One-Time PasswordOne-Time PasswordPassword valid for only a single use or a short period.: Password valid for only a single use or a short period.
  • Passwordless AuthenticationPasswordless AuthenticationAuthentication that does not rely on a shared password, such as through passkeys or hardware tokens.: Authentication that does not rely on a shared password, such as through passkeys or hardware tokens.

Related terms