Multi-Factor Authentication

Multifactor authentication (MFA) to an information system, as described by The DoD, uses two or more methods of authentication involving something you know (e.g., password); something you have (e.g., a One-Time Password (OTP) generating device like a fob, smart-card, or a mobile app on a smart-phone); and something you are (e.g., a biometric like a fingerprint or iris). The traditional authentication method uses a single factor, typically a password, while multifactor authentication requires that a second factor also be used such as PIN sent via a text message (using something you have – the cell phone) or something you are (fingerprint). (Source)

NIST – Multi-Factor Authentication and SP 800-63 Digital Identity Guidelines
This slide presentation identifies Multi-factor Authentication background information and NIST directives.
NIST SP 800-53: IA-2 Identification and Authentication (Organization Users)
Control objectives for the implementation of multi-factor authentication from NIST SP 800-53.
NIST SP 800-63 Digital Identity Guidelines
This NIST Special Publication covers identity proofing and authentication of users interacting with government IT systems over open networks.

BrightTALK – FIDO Deployment Challenges & Best Practices for FIDO Key Management
Webinar presented by Thales and Verasec on challenges and best practices for deploying and managing FIDO (phishing-resistant MFA).
BrightTALK – Two-Factor, Too Furious: Subverting (and Protecting) Multi-factor Authentication
This video is a quick introduction to the problems faced with common MFA systems.
SANS Whitepaper – Two-Factor Authentication (2FA) using OpenOTP
This SANS whitepaper discusses the theory behind user-based two-factor (or multifactor) authentication systems, also known as “2FA”.
Symantec Whitepaper – Two-Factor Authentication
This whitepaper is directed at IT, Security, and Compliance workers who are responsible for recommending or evaluating security products; or running and managing two-factor authentication infrastructure.

CISA – More than a password
CISA's guide for getting started with MFA in your business and personal life.
Duo – Best practices for securing a Duo MFA enrollment Rollout
This guide aims to aid existing and new Duo customers in securing their MFA rollout at their respective organizations.
Duo – Two-Factor Authentication Evaluation Guide
Learn what to look for when assessing and comparing two-factor authentication solutions.
Microsoft – Authentication Methods for AD FS
Guide to enable Multi-factor autheitication for Active Directory Federation Services (AD FS) in Windows Server. Also provide guides for use of common Third-party authentication methods (i.e., Duo, Akamai, RSA, etc.,)
Microsoft – Set up Multi-Factor Authentication for M365
Guide for enforcing MFA for Microsoft 365

Duo Multi-Factor Authentication
Duo's wide variety of authentication methods make it easy for every user to securely and quickly log in.
Gartner – User Authentication Product Reviews and Ratings
Gartner's user authentication product reviews and ratings
RCDevs
OpenOTP is a phishing-resistant MFA solution.
RSA SecurID Access
Secure access to your extended enterprise with RSA SecurID Access, the leading multi-factor authentication and identity assurance solution.
Thales
Gemalto's identity and access management (IAM) solutions allow organizations to meet the evolving needs around cloud applications and mobile devices.
Yubico
Yubikey is a phishing-resistant MFA that stops modern cyber-attacks.

CMMC Related Controls

Level 2 | IA.L2-3.5.3 – Multifactor Authentication: Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

CMMC Assessment Guides

CMMC Level 1 Self-Assessment Guide
This document provides self-assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 1.
CMMC Level 2 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.
CMMC Level 3 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 3.
NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information
The purpose of this publication is to provide procedures for assessing the CUI requirements in NIST Special Publication 800-171.

Resources

Legal