Multi-factor authentication

MFA combines factors from different categories: something you know (a password), something you have (a phone or security key) and something you are (a fingerprint or face). A stolen password alone is no longer enough to sign in, which blocks a large share of account compromise attempts.

MFA is now a baseline expectation. It appears in the Canadian Centre for Cyber Security's baseline controls for small and medium organizations, in CyberSecure Canada, in every major framework and on virtually every Canadian cyber insurance application, often phrased as "MFA on all email, remote access and privileged accounts".

Not all MFA is equally strong. SMS codes can be phished or intercepted through SIM swapping. Push approvals can be abused through MFA fatigue. Adversary-in-the-middle phishing can capture sessions after any non-phishing-resistant method. For most staff, an authenticator app with number matching is a good baseline. Administrators, finance staff and executives should use phishing-resistant MFA such as FIDO2 security keys or passkeys.