Full Report
In this blog, we aim to answer the question: how easy is it for hackers to circumvent two-factor authentication? We look at their tricks to learn the best way to set up 2FA.
Analysis Summary
# Best Practices: Secure Two-Factor Authentication (2FA)
## Overview
These practices address the vulnerabilities inherent in traditional single-factor (password-only) authentication and the specific weaknesses of certain 2FA methods, such as SMS-based verification. The goal is to move organizations toward "phishing-resistant" authentication to prevent account takeovers via SIM swapping and social engineering.
## Key Recommendations
### Immediate Actions
1. **Enable MFA Everywhere:** Turn on Multi-Factor Authentication for all business accounts, starting with email, VPNs, and financial portals.
2. **Audit Current Methods:** Identify where SMS-based 2FA is being used as the primary second factor.
3. **Prioritize High-Value Targets:** Ensure executives and IT administrators (who are primary targets for SIM swapping) are moved off SMS-based 2FA immediately.
### Short-term Improvements (1-3 months)
1. **Transition to Authenticator Apps:** Replace SMS/Text verification with Time-based One-Time Password (TOTP) apps (e.g., Google Authenticator, Microsoft Authenticator, or Authy).
2. **User Education:** Conduct training on the risks of social engineering and "MFA fatigue" (approving push notifications without initiating a login).
3. **Implement SSO:** Integrate Single Sign-On (SSO) with enforced MFA to reduce the number of credentials users must manage and to centralize security policy enforcement.
### Long-term Strategy (3+ months)
1. **Deploy Hardware Tokens:** Move toward FIDO2/WebAuthn standards using physical security keys (e.g., YubiKeys) for maximum protection against phishing.
2. **Conditional Access Policies:** Implement location-based and device-health-based authentication requirements.
3. **Identity Monitoring:** Establish monitoring for Account Takeover (ATO) fraud and anomalous login behavior.
## Implementation Guidance
### For Small Organizations
- **Focus on Ease of Use:** Use free or low-cost authenticator apps rather than hardware tokens to ensure user adoption.
- **Enforce Default Policies:** Enable "Security Defaults" in platforms like Microsoft 365 or Google Workspace.
### For Medium Organizations
- **Centralize Identity:** Implement an Identity Provider (IdP) to manage SSO and MFA across all SaaS applications.
- **Policy Documentation:** Define clear requirements for which roles require hardware tokens vs. mobile apps.
### For Large Enterprises
- **Phishing-Resistance:** Mandate hardware-based 2FA for all privileged accounts.
- **Carrier Hardening:** Work with corporate mobile providers to lock down SIM cards (PIN protection) to prevent unauthorized SIM swaps.
## Configuration Examples
- **TOTP Configuration:** Set the time step to 30 seconds (standard) and ensure the secret key is shared only via secure QR code during enrollment.
- **SSO Integration:** Configure your IdP to deny access if the MFA claim is not present in the SAML/OIDC token.
## Compliance Alignment
- **NIST SP 800-63B:** Guidelines for Authentication and Lifecycle Management (moving away from SMS/PSTN as a "restricted" out-of-band factor).
- **CIS Controls:** Control 6 (Designated Authenticator Management) and Control 11 (Data Recovery).
- **ISO/IEC 27001:** Annex A.9 (Access Control).
## Common Pitfalls to Avoid
- **Over-reliance on SMS:** Assuming SMS is secure despite the prevalence of SIM swapping and intercept attacks.
- **Ignoring "MFA Fatigue":** Users may blindly click "Approve" on push notifications if they are bombarded with requests.
- **Lack of Backup Codes:** Failing to provide users with secure backup codes leads to help-desk bottlenecks and users attempting to bypass security.
## Resources
- **Huntress Blog:** [huntress[.]com/blog]
- **MFA Explainer:** [huntress[.]com/blog/what-is-multi-factor-authentication]
- **FIDO Alliance:** [fidoalliance[.]org]
- **NIST Digital Identity Guidelines:** [pages[.]nist[.]gov/800-63-3/]