Multi-factor authentication
MFA uses different types of authentication factors. Asking for the same factor type several times does not create a multi-factor check.
Multi-factor authentication (MFA) combines different kinds of evidence during sign-in. They include knowledge, possession and biometric characteristics. What matters is the difference between factors, not merely the number of steps displayed.
Example and limit
In a hypothetical portal, sign-in requires a password and proof from a registered device holding a cryptographic key. A password and PIN alone would instead be the same factor type: knowledge.
MFA can better protect account access, but gives the person no additional business permissions. Which order they may edit remains a separate authorisation question. Recovery and device loss also need a planned process. The MFA label alone proves neither phishing resistance nor the security of the entire application.
Sources
Related terms
- Identity and access managementIAM combines management of digital identities with their access rights. Accounts, role changes and removal of old permissions belong together.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- Zero trustZero trust does not derive trust solely from network location. Resource access needs appropriate identity and permission checks.
- WebAuthnWebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- Attribute-based access controlABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.