Multi-Factor Authentication

Multifactor authentication (MFA) to an information system, as described by The DoD, uses two or more methods of authentication involving something you know (e.g., password); something you have (e.g., a One-Time Password (OTP) generating device like a fob, smart-card, or a mobile app on a smart-phone); and something you are (e.g., a biometric like a fingerprint or iris). The traditional authentication method uses a single factor, typically a password, while multifactor authentication requires that a second factor also be used such as PIN sent via a text message (using something you have – the cell phone) or something you are (fingerprint). (Source)

Not all forms of MFA are equally secure. CISA and the DoW encourages organizations to implement phishing-resistant MFA. While any form of MFA is better than no MFA and will reduce an organization’s attack surface, phishing-resistant MFA is the gold standard and organizations should make migrating to it a high priority effort. (Source)

NIST – Multi-Factor Authentication and SP 800-63 Digital Identity Guidelines
This slide presentation identifies Multi-factor Authentication background information and NIST directives.
NIST SP 800-53: IA-2 Identification and Authentication (Organization Users)
Control objectives for the implementation of multi-factor authentication from NIST SP 800-53.
NIST SP 800-63: Digital Identity Guidelines
This NIST Special Publication covers identity proofing and authentication of users interacting with government IT systems over open networks.

BrightTALK – Cybersecurity Roundtable: MFA Bypass and How to Defend Against It
This video consists of a panel of cybersecurity experts discussing advanced MFA bypass techniques and examining how their clients have enhanced their cybersecurity posture to respond.
BrightTALK – FIDO Deployment Challenges & Best Practices for FIDO Key Management
Webinar presented by Thales and Verasec on challenges and best practices for deploying and managing FIDO (phishing-resistant MFA).
CISA – Implementing Phishing-Resistant MFA
This fact sheet is intended to provide for IT leaders and network defenders an improved understanding of current threats against accounts and systems that use multifactor authentication (MFA).
NordLayer – The importance of multi-factor authentication for remote access
This blog post describes why multifactor authentication (MFA) is important for remote access.
Symantec Whitepaper – Two-Factor Authentication
This whitepaper is directed at IT, Security, and Compliance workers who are responsible for recommending or evaluating security products; or running and managing two-factor authentication infrastructure.

Cybersecurity and Infrastructure Security Agency – More than a password
CISA's guide for getting started with MFA in your business and personal life.
Duo – Best practices for securing a Duo MFA enrollment Rollout
This guide aims to aid existing and new Duo customers in securing their MFA rollout at their respective organizations.
Duo – Two-Factor Authentication Evaluation Guide
Learn what to look for when assessing and comparing two-factor authentication solutions.
IBM – What is Phishing Resistant MFA and How Does it Work?
Phishing-resistant MFA is a multifactor authentication method that uses cryptographic keys bound to legitimate websites to verify a user’s identity in a way that resists being intercepted, replayed or socially engineered.
Microsoft – Authentication Methods for AD FS
Guide to enable Multi-factor autheitication for Active Directory Federation Services (AD FS) in Windows Server. Also provide guides for use of common Third-party authentication methods (i.e., Duo, Akamai, RSA, etc.,)
Microsoft – Phishing-resistant MFA (Secure Future Initiative)
Phishing-resistant multifactor authentication (MFA) is part of the protect identities and secrets pillar of the Secure Future Initiative (SFI), which focuses on hardening authentication, eliminating unmanaged credentials, enforcing Zero Trust principles, and protecting cryptographic keys.
Microsoft – Set up Multi-Factor Authentication for M365
Guide for enforcing MFA for Microsoft 365

Duo Multi-Factor Authentication
Duo's wide variety of authentication methods make it easy for every user to securely and quickly log in.
Gartner – User Authentication Product Reviews and Ratings
Gartner's user authentication product reviews and ratings
RCDevs
OpenOTP is a phishing-resistant MFA solution.
RSA SecurID Access
Secure access to your extended enterprise with RSA SecurID Access, the leading multi-factor authentication and identity assurance solution.
Thales
Gemalto's identity and access management (IAM) solutions allow organizations to meet the evolving needs around cloud applications and mobile devices.
Yubico
Yubikey is a phishing-resistant MFA that stops modern cyber-attacks.

CMMC Related Controls

Level 2 | IA.L2-3.5.3 – Multifactor Authentication: Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

CMMC Assessment Guides

CMMC Level 1 Self-Assessment Guide
This document provides self-assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 1.
CMMC Level 2 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.

Resources

Legal