Multi-Factor Authentication — Internal Knowledge Base

Multi-factor authentication (MFA) requires two or more factors from different
categories: something you know (password or PIN), something you have (phone,
hardware token), and something you are (fingerprint, face). Two passwords are
not MFA — the factors must come from different categories.

Our organization requires MFA on all remote access, email, and administrative
accounts. Approved second factors, in order of preference: FIDO2 hardware keys,
the corporate authenticator app with number matching, and time-based one-time
passcodes (TOTP). SMS codes are permitted only as a fallback because SIM-swap
attacks can intercept them.

MFA fatigue (also called push bombing) is an attack in which the adversary,
already holding a stolen password, sends repeated push notifications hoping the
user taps Approve to silence the prompts. Defenses include number matching,
rate-limiting prompts, and user training: an unexpected MFA prompt means your
password is already compromised — deny the prompt and report it immediately.

Lost token procedure: report the loss to the help desk, which disables the
registered factor and issues a temporary bypass code valid for eight hours
after identity verification against the HR record. Backup codes should be
stored in the password manager, never printed or emailed.
