Why Multi-Factor Authentication Still Fails
Turning it on is the easy part. The attacks that work now target the recovery paths around it.
Multi-factor authentication is the single most effective control most organizations can deploy, and it is not a solved problem. Accounts protected by it are still compromised, through routes that go around the second factor rather than through it.
Not all factors are equal
Codes sent by text message are the weakest common form, because a phone number can be moved to an attacker's device through a fraudulent transfer with the mobile carrier. The account holder loses service and, shortly afterwards, the account.
Codes from an authenticator application are meaningfully stronger. Hardware security keys using modern standards are stronger again, because the key verifies the site's identity — a user cannot be tricked into approving a login on a convincing imitation.
Fatigue attacks
Where a system asks the user to approve a push notification, attackers with a stolen password simply request approval repeatedly, often at night, until someone taps accept to stop the noise.
The defense is number matching — the user must enter a number shown on the login screen — which makes reflexive approval impossible.
The recovery path is the real target
Most successful account takeovers now go through recovery rather than login. If a help desk will reset a factor for a caller who knows an employee's date of birth and manager's name, then that is the security of the account.
Define what proof is required to reset a factor, require it without exception, and test it by attempting it yourself.
The accounts that get forgotten
Service accounts, shared mailboxes, contractor access and legacy protocols that predate the requirement are where attackers look, precisely because the rollout announcement covered staff logins and nothing else.
Inventory every route into your systems, not every employee, and check each one.