What is 2FA?
2FA (Two-Factor Authentication) is a form of authentication in which a user proves their identity with exactly two independent factors from different categories, usually a password plus a code or confirmation on a device they carry. A stolen or leaked password is then no longer enough to get in. 2FA is a widely used form of MFA and, in OT environments, matters most for remote access, VPN connections and administrative access to SCADA, HMI and engineering stations.
🧠 Which two factors does 2FA combine?
An authentication factor is a category of proof. It only counts as 2FA when the two factors come from different categories:
| Category | Example | Typical weakness |
|---|---|---|
| Something you know | Password, PIN | Phishing, reuse, guessing |
| Something you have | Authenticator app, hardware token, smartcard, security key | Loss, theft, interception of codes |
| Something you are | Fingerprint, facial recognition | Works poorly with gloves or in dusty environments |
Two passwords in a row, or a password plus a security question, is therefore not 2FA: those are two steps using the same factor. This is sometimes called two-step verification. A code sent by email is also weak in practice, because the mailbox is often protected by the same password.
🔧 How does 2FA work technically?
Most 2FA solutions use one of the following methods for the second factor:
- TOTP (Time-based One-Time Password) - defined in RFC 6238 (May 2011). The app and the server share a secret key and every 30 seconds both calculate the same code, usually six digits, from the key and the current time. TOTP extends HOTP (RFC 4226, December 2005), which uses a counter instead of the time. Well-known apps include Microsoft Authenticator and Google Authenticator. Because the calculation works offline, TOTP suits isolated networks, provided the clocks are synchronised.
- Push notification - the server sends a request to an app and the user approves it. User-friendly, but vulnerable to MFA fatigue: an attacker keeps sending requests until someone approves one by mistake, as happened in the Uber breach of September 2022. Number matching (typing in a displayed number) limits this.
- SMS or voice - a code delivered over the mobile network. Vulnerable to SIM swapping and interception; NIST SP 800-63B-4 (July 2025) classifies SMS and voice as restricted.
- Hardware token, smartcard or security key - a physical device holding a cryptographic key. FIDO U2F (2014) and its successor FIDO2/WebAuthn bind the key to the domain of the service, so a fake login page receives nothing it can reuse.
In corporate networks, verification often runs through Active Directory or an IAM platform, with RADIUS as the link to VPN concentrators, firewalls and jump servers.
🔄 What is the difference between 2FA, MFA and two-step verification?
| Term | Meaning | Example |
|---|---|---|
| 2FA | Exactly two factors from different categories | Password + TOTP code |
| MFA | Two or more factors; 2FA is a subset | Smartcard + PIN + fingerprint |
| Two-step verification | Two steps, not necessarily two categories | Password + security question |
| Phishing-resistant MFA | Factors that cannot be abused through a fake site | FIDO2 security key, PKI smartcard |
Laws and standards usually speak of MFA. A well-configured 2FA solution generally satisfies that, but standards such as IEC 62443-3-3 and guidance from CISA add requirements on factor strength at higher levels.
🎯 Why is 2FA important for OT environments?
Stolen credentials are one of the most common ways into a network, including at industrial companies. Two examples show what happens without a second factor:
- Colonial Pipeline (May 2021) - attackers got in through a legacy VPN account protected by a password alone. The password later turned up in a leaked collection. The ransomware attack hit IT, but the pipeline was shut down for several days as a precaution.
- Hof van Twente (December 2020) - an administrator account with the password “Welkom2020” and no second factor gave attackers access to this Dutch municipality’s network; backups were destroyed.
| Risk without 2FA | Consequence in OT |
|---|---|
| Leaked or reused password | Direct access via VPN or remote maintenance |
| Phishing of credentials | Takeover of an engineering or administrator account |
| Shared vendor accounts | No visibility of who logged in and when |
| Compromised domain account | Lateral movement from IT to OT via the domain controller |
2FA is not complete protection. Phishing kits that sit between the user and the service as an adversary-in-the-middle can relay a TOTP code or push approval and steal the session cookie (session hijacking). That is why you combine 2FA with access control, Zero Trust and security awareness.
🏭 Where do you use 2FA in OT?
| Location | Use of 2FA |
|---|---|
| Remote access | 2FA on the VPN or jump server in the DMZ, never directly to the control system |
| Engineering Station | Sign-in with smartcard or security key, especially for changing PLC logic |
| Historian or SCADA web interface | Additional factor for access from the office network |
| Cloud portals | 2FA mandatory for dashboards, vendor portals and management consoles |
| Privileged accounts | 2FA through a PAM solution with session recording |
| Operator HMI in the control room | Often no 2FA; compensate with physical access control and badge login |
On an operator workstation, security must never block an emergency intervention. IEC 62443-3-3 takes this into account: access control must not prevent essential functions. In OT, the emphasis is therefore on 2FA for access from outside and for administrative and engineering functions.
🔐 What do NIS2, the Dutch Cybersecurity Act and IEC 62443 require?
- NIS2 Article 21(2)(j) - lists “the use of multi-factor authentication or continuous authentication solutions” as a measure, where appropriate. Implementing Regulation (EU) 2024/2690 elaborates on this for digital service providers.
- Cybersecurity Act (Cyberbeveiligingswet) - the Dutch transposition of NIS2, in force since 15 August 2026, takes over this duty of care for essential and important entities.
- IEC 62443-3-3 - SR 1.1 RE 2 requires MFA for human users over an untrusted network from Security Level 3; RE 3 requires MFA on all networks at SL 4.
- ISO 27001 - control 8.5 expects secure authentication, in practice MFA for administrative and external access.
🧭 How do you introduce 2FA step by step?
- Inventory access points - VPNs, remote support tools, jump servers, cloud portals and local administrator accounts on OT systems.
- Start with the biggest risks - first external access and vendor accounts, then administrator and engineering accounts.
- Choose the method per group - security keys or smartcards for administrators, TOTP where the network is offline, SMS only as a temporary exception.
- Centralise - tie 2FA to Active Directory or IAM, and restrict rights with RBAC and least privilege.
- Arrange recovery and emergency access - spare tokens, a sealed break-glass account and a tested process for lost tokens.
- Monitor - send failed 2FA attempts and unusual approvals to the SIEM.
❓ Frequently asked questions
Is 2FA the same as MFA?
2FA is a form of MFA that uses exactly two factors. MFA means two or more factors from different categories. In practice, most organisations use 2FA to meet the MFA requirements of NIS2 or IEC 62443.
Which 2FA method is the most secure?
A FIDO2 security key or PKI smartcard is the most secure form of 2FA, because the key is bound to the genuine domain and cannot be abused through phishing. TOTP apps are a good middle ground. SMS is the weakest 2FA method because of SIM swapping and interception.
Can 2FA be bypassed?
Yes, 2FA based on one-time codes or push notifications can be bypassed through adversary-in-the-middle phishing, MFA fatigue or SIM swapping. A session cookie stolen after sign-in also sidesteps the second factor. Phishing-resistant methods and monitoring make this much harder.
Does 2FA work without an internet connection?
Yes, TOTP codes and smartcards work without internet access, because verification takes place locally against an on-premises server. That makes these forms of 2FA suitable for isolated OT networks. Push notifications and SMS do require a connection to the internet or the mobile network.
Is 2FA mandatory under the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act (Cyberbeveiligingswet) does not prescribe a specific technique, but it follows NIS2, which explicitly lists multi-factor authentication as a measure. For essential and important entities, 2FA on external and administrative access is therefore the expected baseline. If you do not implement it, you need to be able to explain why it is not appropriate.
Should a vendor use 2FA for remote maintenance?
Yes, remote maintenance by vendors is one of the most important places for 2FA in OT. Every technician should have a personal account with a second factor, preferably through a jump server with session recording. Shared vendor accounts without 2FA are a well-known cause of incidents.
📌 In summary
2FA combines two factors from different categories, usually a password with an app, token or security key. In OT it mainly protects remote access, vendor access and administrator and engineering accounts, and that is also where NIS2, the Dutch Cybersecurity Act and IEC 62443 expect it.
2FA is a foundational layer of modern OT/IT security: it keeps attackers out even when a password has been leaked or phished. Choose phishing-resistant methods where possible, enforce 2FA on every access from outside, and make sure it never blocks an operator’s emergency intervention.