MFA

What is MFA?

MFA (Multi-Factor Authentication) is a form of authentication in which a user proves their identity with at least two independent factors from different categories: something they know, something they have or something they are. A stolen or guessed password is then no longer enough to get in. This makes MFA one of the most effective security controls against account takeover, and it is explicitly named in NIS2 and IEC 62443-3-3; ISO 27001 also expects strong, secure authentication through control 8.5. In OT environments, MFA is above all indispensable for remote access and administrative access to control systems.

🧠 What are the authentication factors?

An MFA solution combines at least two of these three categories. Using the same category twice, such as a password plus a security question, is not MFA.

In practice, biometrics are usually used locally to unlock a possession factor, for example a fingerprint on a phone or security key. The biometric data then never leaves the device. Two-factor authentication (2FA) is the most common form of MFA, using exactly two factors.

🔧 Which MFA methods exist and how strong are they?

Not all MFA is equally strong. The US agency CISA published a ranking in October 2022 that is now widely followed:

Notes on the main methods:

• FIDO2 and passkeys - FIDO2 combines the W3C WebAuthn standard with the FIDO Alliance’s CTAP protocol. The key only signs a request from the genuine domain, so a spoofed sign-in page receives nothing usable. On 5 May 2022, Apple, Google and Microsoft jointly announced support for passkeys, FIDO credentials stored on the device or synchronised between devices.
• Smart cards - PKI-based MFA, such as the US government’s PIV card, is also phishing-resistant. It does require sound certificate management and fits well with Active Directory environments.
• SMS - the weakest form. NIST SP 800-63B-4 (July 2025) classifies SMS and voice as a restricted authenticator, permitted only with a risk assessment and a migration plan. Email is generally not regarded as a possession factor, because the mailbox is often protected by the same password.
• Push bombing - attackers holding a stolen password send dozens of push notifications until the victim, worn down, taps “Approve”. This happened at Uber in September 2022, combined with social engineering via WhatsApp. Microsoft has enforced number matching in Authenticator since 8 May 2023.

🎯 Why is MFA so important?

• Stolen passwords become worthless - according to Microsoft, MFA blocks more than 99.9% of automated attacks on accounts, such as credential stuffing and password spraying.
• Protection of the network perimeter - VPN, RDP and remote maintenance portals are favourite entry points for ransomware groups.
• Limiting the damage from phishing - provided you use phishing-resistant methods; codes and push notifications can still be intercepted by an adversary-in-the-middle proxy.
• Compliance - MFA is an explicit requirement or expected control in NIS2, the Dutch Cybersecurity Act, ISO 27002 (control 8.5) and the BIO.
• Foundation for Zero Trust - every access decision requires a strongly established identity.

The attack on Colonial Pipeline in May 2021 shows what happens without MFA. The attackers logged in to an old but still active VPN account using a password that had surfaced in an earlier data breach. The account had no second factor. The ransomware only hit IT, yet the largest fuel pipeline in the United States was shut down for six days as a precaution.

🏭 How do you apply MFA in OT environments?

In OT the emphasis differs from IT. The principle is: MFA at the boundary, fast and predictable inside the control room.

• Remote access - every connection from outside into the OT network, including those of vendors and integrators, runs through a jump server or secure remote access solution in the DMZ, with MFA at sign-in.
• Administrative and engineering access - access with administrative rights to engineering workstations, SCADA servers and the historian goes through PAM with MFA and session recording.
• Operator workstations - at an HMI, an operator must be able to intervene immediately during an upset. IEC 62443-3-3 therefore warns that access must not be denied automatically when an immediate operator response is required in an emergency. Shared operator accounts are often compensated here with physical access control to the control room, fast badge login or personal accounts with a short PIN.
• Legacy systems - many older PLCs, HMIs and Windows stations do not support MFA. In that case you enforce MFA at the layer in front of them: the jump server, the VPN or the firewall of the zone.
• Offline and isolated networks - cloud-based push apps do not work without internet. Choose hardware tokens, smart cards or FIDO2 keys that validate locally against an on-premises identity server instead.

Emergency access (break glass) belongs in every MFA design for OT. When the MFA server, the identity service or the network fails, a plant must remain controllable. A classic approach is the Red Envelope procedure: the credentials of an emergency account are kept in a sealed envelope in a safe. After use, the password is changed immediately and the use is recorded. Modern variants keep emergency accounts in a PAM vault with dual approval and extensive logging.

🔐 What do NIS2 and IEC 62443 require on MFA?

For component suppliers, IEC 62443-4-2 translates the same requirements to the level of individual devices and software. Under NIS2, the management body is also accountable: it must approve measures such as MFA and oversee their implementation.

🧭 How do you roll out MFA step by step?

1. Inventory the access paths - which accounts, VPNs, remote tools and management interfaces exist, including those of vendors? Remove unused accounts straight away.
2. Start with the highest risk - administrators, help desk, remote access and email first; CISA recommends a phased rollout.
3. Choose the method per group - FIDO2 keys or smart cards for administrators and OT engineers, number matching or TOTP as an interim step, SMS only as an exception with an end date.
4. Design for OT constraints - local validation in isolated zones, no dependency on the internet for control, and a documented break-glass procedure.
5. Organise the recovery process - replacing a lost token is a favourite entry point for social engineering; verify users carefully at re-enrolment.
6. Monitor and test - log failed and rejected MFA attempts in the SIEM, watch for bursts of push notifications and rehearse the emergency procedure periodically.

Always combine MFA with least privilege, identity management through IAM, access management and network segmentation: MFA proves who is signing in, not what they are allowed to do.

❓ Frequently asked questions

What is the difference between MFA and 2FA?

2FA (two-factor authentication) uses exactly two factors, while MFA uses at least two. Every 2FA setup is therefore MFA, but MFA can also combine three factors, such as a smart card with a PIN and a fingerprint. In practice the terms are often used interchangeably.

Is SMS-based MFA still secure enough?

SMS-based MFA is better than a password alone, but it is the weakest form of MFA. Codes can be intercepted through SIM swapping, abuse of the SS7 protocol or a phishing site. NIST therefore restricts SMS to exceptions, and CISA advises moving to phishing-resistant MFA.

What is phishing-resistant MFA?

Phishing-resistant MFA is authentication that is useless to an attacker even if the user lands on a spoofed sign-in page. According to CISA, only FIDO2/WebAuthn (security keys and passkeys) and PKI smart cards meet that bar, because the cryptographic key is bound to the genuine domain or service.

What is an MFA fatigue attack?

An MFA fatigue attack, also called push bombing, is an attack in which an attacker with a stolen password repeatedly sends push notifications to the victim until one is approved. Number matching, a limit on the number of attempts and phishing-resistant MFA prevent this.

Is MFA mandatory under NIS2?

NIS2 explicitly lists MFA or continuous authentication in Article 21 as a measure organisations must take “where appropriate”. For digital service providers such as cloud and managed service providers, Implementing Regulation (EU) 2024/2690 makes this concrete, and in other sectors too MFA is in practice an expected control for remote access and administrator accounts. In the Netherlands this applies through the Cyberbeveiligingswet.

Can you use MFA on an HMI in the control room?

MFA on an HMI is possible, but it must never prevent an operator from intervening in an emergency. That is why many organisations apply MFA to remote access, engineering and administrative functions, and protect operator workstations with physical access control and fast badge login. IEC 62443-3-3 takes this into account: access control must not block essential functions or emergency intervention.

📌 In summary

MFA requires at least two independent proofs of identity and is one of the most effective controls against the misuse of stolen passwords. Choose phishing-resistant methods such as FIDO2 or smart cards wherever possible, enforce MFA in OT on every access from outside and every administrative function, and keep a tested emergency procedure, so that security never comes at the expense of process control.