Among the Core Strategies in the ACSC Essential Eight, Multi-Factor Authentication (MFA) is routinely cited as the most critical defense against modern threat actors. Passwords alone are effectively useless in today's threat landscape.
The Essential Eight View on MFA
According to the framework, MFA must be applied to all:
- Remote access solutions (like VPNs).
- Customer portals, third-party portals, and cloud services (like Microsoft 365, Google Workspace, AWS).
- Users performing administrative duties.
Not All MFA is Created Equal
A crucial detail in the Essential Eight Maturity Levels is the type of MFA used.
- Maturity Level 1: SMS-based MFA and email codes are generally acceptable, though highly discouraged, to achieve the lowest passing grade.
- Maturity Level 2: Requires the use of "something you have", typically meaning authenticator apps (like Authy, Microsoft Authenticator) that generate Time-based One-Time Passwords (TOTP). SMS is increasingly seen as inadequate due to SIM-swapping attacks.
- Maturity Level 3: Demands phishing-resistant MFA. This specifically refers to hardware tokens utilizing the FIDO2/WebAuthn protocols (such as YubiKeys).
Closing the MFA Gap
Many businesses enable MFA for their emails but forget about their VPN, HR platforms, or accounting software. This creates a dangerous backdoor. Check if your MFA coverage is truly complete by running through our Essential Eight Health Check today.