CyberStack

Knowledge / identity acsc-glossary

Multi-factor authentication

Two or more different factor types: know, have, or are. SMS counts. So does intercepting it. Aim for phishing-resistant.

MFA / something you know + have + areKnowledgepassword / pinPossessionkey / tokenInherencebiometricPhishable MFA is still MFA. Prefer phishing-resistant factors.

MFA is authentication that demands two or more different kinds of proof: something you know, something you have, or something you are. Two passwords is still one factor wearing a hat.

SMS codes and push prompts are factors. They are also interceptable and social-engineerable. FIDO2, passkeys, and hardware tokens for admin, email, and remote access are the adult version.

Essential Eight names MFA for a reason. Privileged access without it is not a mature program. Keep recovery flows from becoming a single-factor alley around the side.

Fact source: ASD's ACSC glossary. Wording is Cyberstack's.