Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is Multi-Factor Authentication (MFA)?

Definition

Multi-factor authentication (MFA) means proving who you are with two or more different kinds of evidence before an account opens: something you know (a password), something you have (a phone app or security key), or something you are (a fingerprint). A stolen password alone is no longer enough to log in.

How It Works

NIST SP 800-63B-4 (July 2025) describes authentication by "authenticators," and higher assurance requires proof of two distinct factors. In practice a login asks for your password, then a second step such as:

  • A code sent by text message or shown in an authenticator app.
  • A push prompt you approve on your phone.
  • A security key or passkey that performs a cryptographic check with the real website.

Not all second factors are equal. NIST treats text message and voice codes (the phone network, or PSTN) as a "restricted" authenticator, and states that anything where you type in a code (one-time passwords and out-of-band codes) is not phishing-resistant, because a fake login page can relay the code to the real one. Phishing resistance requires cryptographic authentication bound to the real site.

CISA's fact sheet on phishing-resistant MFA lists the attacks that beat weaker methods: phishing, push bombing (flooding a user with prompts until they tap "approve"), SS7 phone network exploits, and SIM swaps. CISA calls FIDO/WebAuthn and PKI-based MFA the "gold standard," and recommends number matching where push apps are still in use.

Real-World Example

In written testimony to the Senate Finance Committee on May 1, 2024, UnitedHealth Group CEO Andrew Witty described how the Change Healthcare attack began: on February 12, 2024, "criminals used compromised credentials to remotely access a Change Healthcare Citrix portal, an application used to enable remote access to desktops. The portal did not have multi-factor authentication." The attacker moved laterally, stole data, and deployed ransomware nine days later. One remote access portal without a second factor was the way in.

Why It Matters for a Small Business

Stolen and reused passwords are a constant in breach data. Verizon's 2026 Data Breach Investigations Report found that credential abuse was the initial access vector in 13% of small and medium business breaches, and that credentials were among the data compromised in 31% of them. Counting every stage of an attack, not just the first step, credential abuse appeared in 39% of all breaches.

CISA's position is practical: "any form of MFA is better than no MFA," but phishing-resistant MFA should be the goal. For a small business, the accounts to cover first are email, remote access (VPN, remote desktop, Citrix), banking, payroll, and website admin logins.

How to Spot It / How DTS Handles It

Gaps to check: any login that works with a password alone; shared accounts nobody enrolled; old protocols that skip MFA; and users who get prompts they did not trigger (a sign someone has their password). An unexpected MFA prompt should be reported, never approved.

DTS can help with turning on MFA across Microsoft 365, moving admins to security keys or passkeys, enabling number matching, and blocking legacy sign-ins. See our Microsoft 365 security and administration service.

Related Terms

  • Account takeover: what MFA is designed to prevent.
  • Credential stuffing: reused passwords fail when a second factor is required.
  • Phishing: the main reason code-based MFA is not enough on its own.
  • Phishing-resistant MFA (FIDO2): security keys and passkeys that a fake page cannot relay.
  • MFA fatigue: push bombing, and why number matching helps.
  • Password manager: the other half of good login hygiene.
  • Business email compromise: often starts with a mailbox that had no MFA.

Sources

  • NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025): https://csrc.nist.gov/pubs/sp/800/63/b/4/final
  • CISA, Implementing Phishing-Resistant MFA fact sheet (October 2022): https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
  • Testimony of Andrew Witty, UnitedHealth Group, Senate Finance Committee (May 1, 2024): https://www.finance.senate.gov/imo/media/doc/0501_witty_testimony.pdf
  • Verizon, 2026 Data Breach Investigations Report (initial access vectors; SMB focused analysis): https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf

Last updated October 14, 2026.