Identity and access management: why MFA type matters as much as MFA itself
Most attacks now start with a stolen login. CISA's guidance is blunt: SMS codes and push approvals can be beaten, and only phishing-resistant MFA closes the gap.
Identity and access management, or IAM, is the set of tools and rules that decide who can sign in to what, and what they can do once inside. As more systems moved to the cloud, the login became the main thing standing between an attacker and company data.
Most companies already require multifactor authentication somewhere. The question that matters now is which kind.
Not all MFA is equal
In late 2022, CISA published a fact sheet on phishing-resistant MFA that sorted the common methods by strength. Its message has held up:
| Method | CISA's view | How it fails |
|---|---|---|
| FIDO2 / WebAuthn (security keys, passkeys, platform authenticators) | Phishing-resistant | Very hard to phish, because the key checks the real website |
| PKI smart cards with single sign-on | Phishing-resistant | Strong, but harder to deploy outside government |
| App push approvals and one-time codes | Vulnerable | Users can be tricked into entering codes on a fake site, or worn down by repeated push requests ("MFA fatigue") |
| SMS and voice codes | Weakest, last resort | Exposed to SIM swapping and phone network attacks, as well as phishing |
CISA described FIDO and WebAuthn as the only widely available phishing-resistant forms of MFA. Where push approvals have to stay for now, it recommends number matching, which makes the user type a number shown on the login screen into the app, so a stray tap can't approve an attacker.
The IAM basics that matter most
MFA type is one control. A working IAM program for a mid-size company also covers:
- One identity provider for workforce sign-in, so access can be granted and removed in one place.
- Phishing-resistant MFA for admins first, then email and remote access, then everyone else.
- Automatic onboarding and offboarding linked to HR records, so leavers lose access on their last day.
- Least privilege. Give people the access their role needs, and grant admin rights only for the time they are needed.
- Regular access reviews, especially for finance systems, customer data and admin roles.
- Service accounts and API keys under control, each with an owner, limited permissions and rotation.
What IT teams should do
- Move all admin accounts to security keys or passkeys.
- Turn on number matching for any push-based MFA you keep.
- Remove SMS as an MFA option wherever a stronger method is available.
- Check that leavers lose access on their last day, and fix the process if they don't.