ASD ISM 1682Phishing-resistant multi-factor authentication for human users of systems

What this means in practice

Multi-factor authentication (MFA) asks for something more than a password before a person is let in. This control goes one step further: the second factor that human users rely on must be phishing-resistant. That means the authentication cannot be tricked out of the user by a fake login page, a convincing email or a scam phone call, and cannot be relayed by an attacker sitting between the user and the real system. Weaker MFA methods such as SMS codes, emailed codes, one-time codes typed from an app, or "approve this sign-in" push prompts can all be captured or manipulated. An attacker sets up a look-alike login page, the user enters their password and their six-digit code, and the attacker passes both to the real system in real time. Push prompts can be defeated by bombarding the user until they tap approve. Phishing-resistant methods, by contrast, bind the authentication to the genuine service so that a code or approval given to the wrong site is useless. In practice this means FIDO2/WebAuthn security keys, passkeys, smart cards (such as PIV cards) and platform authenticators such as Windows Hello for Business. This matters because most successful account takeovers begin with a phished credential. If the second factor can be phished as easily as the password, MFA gives a false sense of security. The control applies to human users of systems; it does not address authentication of services, devices or automated processes.