MFA
IMPLEMENTATION
UK

Passwords are broken. Billions of credentials have been leaked in data breaches and are freely available on the dark web. Credential stuffing attacks (trying known username/password combinations against your services) run 24/7 at scale. Phishing campaigns successfully steal passwords from employees every day.

MFA means a stolen password alone cannot compromise an account. An attacker needs both the password and the second factor — which is in the user's possession. Microsoft's data shows MFA prevents 99.9% of automated account compromise attacks and 66% of targeted phishing attacks.

UK businesses have a regulatory and insurance imperative to implement MFA: Cyber Essentials requires it on all internet-accessible accounts, the ICO considers lack of MFA as inadequate security under GDPR, and cyber insurers now commonly refuse claims or cancel policies when breaches result from accounts without MFA.

Standard MFA (SMS codes, basic authenticator app push notifications) can be bypassed by sophisticated attackers using adversary-in-the-middle (AiTM) phishing kits. These intercept MFA tokens in real time, allowing attackers to access accounts even when standard MFA is enabled.

Phishing-resistant MFA uses cryptographic binding to the domain — the authentication is tied to the specific website being accessed and cannot be intercepted by a proxy. FIDO2 hardware keys (YubiKey), Windows Hello for Business, and Microsoft Passkeys are all phishing-resistant.

We recommend phishing-resistant MFA for all admin accounts, finance team members, senior executives, and anyone with access to highly sensitive data. For the wider user base, Microsoft Authenticator with number-matching provides strong protection against the majority of attacks.