CME-801

Multi-Factor Authentication (MFA)

Harden Identity Unquantified evidence Preventive

Description

Enforce multi-factor authentication (MFA) requiring two or more independent authentication factors before granting access. Supported second factors include time-based one-time passwords (TOTP via authenticator apps), FIDO2/WebAuthn hardware security keys, smart cards (PIV/CAC via PKCS#11), and push-based approval. MFA ensures that a compromised password alone is insufficient for account access — the attacker must also obtain or bypass the second factor through a separate channel (physical theft, real-time phishing proxy, SIM swap), each of which adds substantial complexity. FIDO2 keys provide the strongest protection as they are bound to the origin and resistant to phishing. TOTP is vulnerable to real-time proxy phishing (e.g., EvilGinx2) but still requires significantly more attack infrastructure than password-only attacks. MFA is enforced at the authentication layer via PAM modules (Linux), conditional access policies (Azure AD/Entra ID), or IdP configuration (Keycloak, Okta, FreeIPA).

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	A stolen password alone cannot authenticate — the attacker must also obtain the second factor through a separate channel (physical theft of a hardware key, real-time phishing proxy to capture TOTP, SIM swap for SMS codes). Each bypass requires substantially more infrastructure and attacker proximity than password-only credential abuse, raising exploitation complexity from trivial replay to a multi-stage attack

CWE Relationships

CWE-287 CWE-521 CWE-303 CWE-305 CWE-798

ATT&CK Technique Crosswalks

Verification

Verify MFA enforcement via PAM modules, SSSD/FreeIPA OTP, smart card, or IdP conditional access policy

$ grep -rE 'pam_google_authenticator|pam_oath|pam_u2f|pam_duo' /etc/pam.d/ 2>/dev/null | grep -c 'auth.*required'
# Expected: >=1

Platform: linux

$ grep -c 'pam_sss' /etc/pam.d/system-auth 2>/dev/null && ipa user-show admin --all 2>/dev/null | grep -i 'authentication types' | grep -ic 'otp'
# Expected: >=1

Platform: rhel

$ grep -rE 'pam_pkcs11|pam_p11' /etc/pam.d/ 2>/dev/null | grep -c 'auth'
# Expected: >=1

Platform: linux

$ Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.GrantControls.BuiltInControls -contains 'mfa' -and $_.State -eq 'enabled'} | Measure-Object | Select-Object -ExpandProperty Count
# Expected: >=1

Platform: windows

Remediation

linux PAM TOTP via google-authenticator module


dnf install -y google-authenticator || apt install -y libpam-google-authenticator
grep -q 'pam_google_authenticator' /etc/pam.d/system-auth 2>/dev/null || sed -i '/^auth.*pam_unix/a auth       required     pam_google_authenticator.so nullok' /etc/pam.d/system-auth
grep -q '^AuthenticationMethods' /etc/ssh/sshd_config 2>/dev/null || printf 'AuthenticationMethods publickey,keyboard-interactive\nChallengeResponseAuthentication yes\n' >> /etc/ssh/sshd_config
systemctl restart sshd

linux PAM FIDO2/U2F via pam_u2f module


dnf install -y pam-u2f || apt install -y libpam-u2f
grep -q 'pam_u2f' /etc/pam.d/system-auth 2>/dev/null || sed -i '/^auth.*pam_unix/a auth       required     pam_u2f.so' /etc/pam.d/system-auth