Multifactor authentication is an important account control, but not every MFA method offers the same resistance to phishing. CISA guidance identifies FIDO authenticators and PKI credentials as phishing-resistant approaches.
Start with the accounts that matter most
Inventory administrator, cloud-console, identity-provider, source-code, finance, remote-access, and other accounts with broad or sensitive access. Prioritize privileged users and systems where an account takeover could have wide impact.
Check what each service supports
Document whether the service supports passkeys or FIDO security keys, PKI-based authentication, recovery methods, multiple registered authenticators, and administrative enforcement. Keep an approved fallback plan for legitimate recovery.
Enroll more than one usable authenticator
Where the platform allows it, avoid creating a single point of failure. Register appropriate backup authenticators and protect recovery procedures with controls proportionate to the account.
Reduce weaker fallbacks
A phishing-resistant primary method can be undermined if an attacker can easily fall back to a weaker recovery or authentication path. Review SMS, email recovery, help-desk reset procedures, legacy protocols, and exceptions before claiming the migration is complete.
Monitor authentication events
Review failed sign-ins, denied MFA attempts, unusual recovery events, new authenticator registrations, and privileged-account changes. CISA guidance also recommends tracking denied or attempted MFA logins.
Apply requirements proportionately
Authentication design should reflect business risk, platform capability, accessibility, continuity needs, and applicable contractual or regulatory obligations. Security teams should involve qualified compliance, privacy, legal, or accessibility specialists where those requirements apply.
Related knowledge
Continue with Privileged Access Reviews, Service Account Security, Security Logging for Business SaaS, and Secrets and Credential Management.
References
- CISA: Identity and Access Management Recommended Best Practices for Administrators
- CISA: Phishing Guidance, Stopping the Attack Cycle at Phase One
This is general cybersecurity guidance and does not establish compliance with any specific law, regulation, contract, or security standard.