Multi-factor authentication for your corporate online services
Page 2 of 7
Why MFA matters
Before the adoption of public cloud services, organisations hosted their corporate digital services on their private premises, accessible only via their local network. Usernames and passwords were added to these services to authenticate requests for access to corporate data. For these services, physical access to the network from only inside the work premises acted as a ‘pseudo second factor’. That is, the user authenticates by demonstrating they:
- know a correct secret password
- are present at the physical private network
However, organisations are increasingly storing their corporate sensitive data in online services (that is, services that are exposed to the internet). These online services are commonly hosted in the cloud, or on-premises reachable using a remote connection such as a virtual private network (VPN) or zero trust network access (ZTNA).
The loss of this pseudo second factor (that is, the lack of only local access to the network) means that authenticating a user to an online service using only a password is not strong enough to protect any sensitive data.
We know that attackers have many ways to steal passwords, which is why the NCSC's password guidance advises that administrators implement MFA to provide additional protection. However, in response to increased adoption of MFA, attackers have developed new methods to access accounts protected by weaker methods of MFA. For example:
- the One-Time Password (OTP) interception attack (or ‘machine-in-the-middle attack'), where a user is convinced to enter their OTP code into a disguised phishing website, giving the attacker the credentials they need to sign-in to the real website as that user
- the push notification fatigue attack (or ‘prompt bombing attack’), where a user is bombarded with approval prompts until they mistakenly approve the attacker’s sign-in request
Implement the strongest available MFA options
You should implement support for the strongest methods of MFA that are available to the expected users of your corporate service, ideally allowing them to choose their preferred method from all the options that meet your organisation’s security needs and risk appetite on protecting corporate data.
As this guidance explains, certain MFA implementations provide ‘stronger’ security than others. However, we also recognise there may be technical or cost considerations that limit your choice. For this reason, it’s important to remember that any implementation of MFA is still superior to reliance on passwords alone.
Provide users with a choice of authentication
There are many methods of achieving MFA, each having their benefits and drawbacks for security, accessibility and usability. Mandating the use of a single method of MFA may seem like the easiest approach, but it often means you end up with frustrated users forced to adopt your specified method, when there are more secure or usable alternatives available.
For example:
Mandating the use of an OTP code-based generator for everyone is an accessible option that works for staff even in places that have poor mobile signal, but it requires that all staff have a trusted mobile device or generator. For those staff that already have a trusted mobile device, they may be able to benefit from the use of phishing-resistant MFA options (like FIDO2 or challenge-based authentication) as well.
Mandating the use of a roaming FIDO2 key for everyone is phishing-resistant, portable, and requires no mobile signal, but it can be costly to adopt for all staff and is an extra device for them to carry around (and to potentially forget or lose). For those staff that already have a trusted mobile device, they may be able to benefit from platform-based FIDO2 keys, or an authenticator app.