Why stronger MFA must be enforced?

While other forms of identity security practices, including SSO, ZTA, IAM, PAM, RBAC, and JIT, are available for securing access and identities, MFA is being pushed by experts for its adaptive and multi-layered protection.

A great deal of identity-based attacks can be protected against by using stronger forms of MFA that don’t rely on phishable codes, according to Sampson. “Stop relying on MFA methods that require a user to enter a code – whether by received by SMS, email, or authenticator app,” he said. “Hardware keys based on the FIDO approach are the strongest option we have currently.”

The study found organizations continue to have some degree of reliance on weaker forms of MFA, specifically those that use one-time codes (99.2%). This is despite 90% of organizations identifying six or more reasons as being highly important for using MFA, led by reducing the likelihood of account takeover.