Two-Factor Authentication (2FA)
Authentication requiring evidence from two distinct factor categories before access is granted.
2FA blocks most attacks that rely on stolen or reused passwords, which protects email, CRM and cloud admin accounts, and it is often required by cyber insurers, customers and compliance frameworks.
An agency enforces 2FA in Google Workspace for all 35 staff, requires hardware security keys for 4 admin accounts, disables SMS codes, and issues backup codes stored in the company password manager.
SMS and push-based methods can be defeated by SIM swapping, phishing proxies or push fatigue attacks. 2FA does not protect sessions already hijacked after login, and weak account recovery can bypass it entirely.
Factors fall into three categories: something you know (password or PIN), something you have (phone, hardware key) and something you are (biometrics). Common second factors include TOTP codes from authenticator apps, which RFC 6238 computes from a shared secret and a 30-second time step, push approvals and FIDO2 or WebAuthn security keys, which resist phishing by binding the login to the site's origin.
Systems Architecture
NIST — SP 800-63B Digital Identity Guidelines: Authentication and Authenticator Management — https://pages.nist.gov/800-63-4/sp800-63b.html; CISA — More than a Password — https://www.cisa.gov/MFA