MFA (multi-factor authentication)

On May 1, 2024, before the Senate Finance Committee, UnitedHealth Group CEO Andrew Witty confirmed that the Change Healthcare attackers got in that February with stolen credentials, through a Citrix remote-access portal that had no MFA. Multi-factor authentication requires, on top of the password, at least one factor from a different category: something you have (a FIDO2 key, a hardware token, a phone receiving a code or a push) or something you are (biometrics). A PIN or a security question added to a password stays in the knowledge category and does not make a second factor. MFA makes a stolen password useless on its own and stops most credential stuffing. It does not stop everything: an adversary-in-the-middle phishing proxy relays the code or steals the session cookie, and push bombing eventually wears a user into approving. Hence the preference of current standards for phishing-resistant factors, FIDO2/WebAuthn, bound to the site's origin. In cyber underwriting, MFA on remote access (VPN, RDP, webmail) and on admin accounts has become a condition of entry, and its absence can mean a declination or a partial exclusion. Some wordings go further, with a partial forfeiture if a loss occurs while the exposed access point had no MFA. Three years earlier, in May 2021, DarkSide had entered Colonial Pipeline through a legacy VPN account protected by a single password; its CEO confirmed it to the Senate in June. For the insurer, MFA also signals the insured's security maturity, which helps it screen out adverse selection.