Multi-factor authentication: the simplest, most effective defence layer

1Introduction

Passwords alone no longer withstand phishing, database leaks and reuse.

2Discussion

MFA combines at least two of: something you know, have or are. A leaked password is useless without the second factor.

SMS is weakest, TOTP apps moderate, FIDO2 hardware keys most phishing-resistant.

3Conclusion

Requiring MFA for admin, remote and payment access is the highest-return, lowest-cost security investment.