What is Two Factor Authentication and why should I use it?

Two-Factor Authentication (2FA), often grouped under the broader term Multi-Factor Authentication (MFA), is a security mechanism that requires more than one form of verification to prove a user’s identity when accessing a system.

In simple terms, instead of relying solely on a username and password, 2FA forces the user to provide a second, independent factor before access is granted.

As IT professionals, we’ve spent decades training users to “pick a strong password” — and yet breaches continue at scale. That’s not because users are lazy; it’s because passwords alone are fundamentally broken.

2FA exists to solve that problem.

Why Passwords Alone Are No Longer Enough

In theory, passwords work. In the real world, they fail constantly.

Here’s what we see in live environments:

• Credentials reused across multiple services
• Passwords harvested via phishing kits in minutes
• Password hashes dumped from breached SaaS platforms
• MFA-less service accounts exploited silently
• Users approving fake login pages that look pixel-perfect

Even when passwords are long and complex, they are still a single point of failure. Once compromised, an attacker has everything they need.

This is why nearly every major breach investigation today begins with:

“The attacker gained access using valid credentials.”

2FA breaks that chain.

How Two-Factor Authentication Works (In Practice)

Traditional logins rely on single-factor authentication — something you know (a password).

2FA introduces a second factor from a different category, typically:

1. Something you know – password or PIN
2. Something you have – phone, hardware token, smart card
3. Something you are – fingerprint, face, biometric data

To authenticate successfully, the user must prove at least two of these.

A Real-World Example

Let’s say a user logs into Microsoft 365:

1. User enters email address and password
2. Password is validated successfully
3. The system prompts for MFA
4. A push notification is sent to their phone
5. User approves the sign-in
6. Access is granted

If an attacker steals the password but doesn’t have the phone — authentication stops cold.

Why 2FA Works So Well Against Modern Attacks

From experience, here’s why MFA is so effective:

• Phishing-resistant (when implemented correctly)
• Stops credential stuffing attacks entirely
• Prevents brute-force login attempts
• Reduces breach impact even after password exposure

Microsoft has stated repeatedly that MFA blocks over 99% of automated account attacks. In real enterprise environments, the difference is even more obvious — tenants without MFA get hammered daily.

Those with enforced MFA? Quiet logs.

Common Two-Factor Authentication Methods (Ranked by Security)

Not all 2FA methods are created equal. This is where many articles oversimplify — and where IT pros need nuance.

1. Authenticator Apps (Recommended)

Examples:

• Microsoft Authenticator
• Google Authenticator
• Authy

How it works:
Time-based one-time passwords (TOTP) or push approvals.

Pros

• Strong security
• Works offline (TOTP)
• Resistant to SIM swap attacks

Cons

• Requires phone access
• Needs backup/recovery planning

👉 Best balance of usability and security for most organisations

2. Hardware Security Keys (Best for High Security)

Examples:

• YubiKey
• FIDO2 keys

How it works:
Cryptographic challenge-response via USB/NFC.

Pros

• Phishing-resistant
• No shared secrets
• Extremely secure

Cons

• Cost
• Physical loss risk
• User training required

👉 Gold standard for admins, executives, and privileged accounts

3. SMS-Based MFA (Use Only If You Must)

How it works:
One-time code sent via SMS.

Pros

• Easy to deploy
• Familiar to users

Cons

• Vulnerable to SIM swapping
• Messages can be intercepted
• Not phishing-resistant

👉 Better than nothing — but no longer considered strong MFA

4. Security Questions (Avoid)

Pros

• Simple

Cons

• Answers often guessable
• Easily found on social media
• Poor auditability

👉 Should not be used as a primary MFA factor

5. Biometrics (Supplementary)

Examples:

• Fingerprint
• Face recognition

Pros

• Fast
• User-friendly

Cons

• Device-dependent
• Privacy considerations

👉 Excellent as part of passwordless strategies, not standalone MFA

2FA vs MFA: What’s the Difference?

This trips people up.

• 2FA = exactly two authentication factors
• MFA = two or more factors

In modern cloud environments, MFA is often adaptive:

• Location-based
• Risk-based
• Device compliance-based

For example:

• No MFA prompt on a trusted corporate device
• MFA enforced when logging in from a new country

This is where security and usability finally meet.

Real-World Lessons from the Field

After years on service desks, sysadmin roles, and now security-focused work, a few truths stand out:

• Users don’t hate MFA — they hate poorly implemented MFA
• Push fatigue attacks are real and increasing
• MFA without monitoring is not “set and forget”
• Break-glass accounts without MFA are a ticking time bomb

One of the most common mistakes I see is deploying MFA but excluding admins “temporarily” — and then never fixing it.

Attackers know this. They look for it.

Best Practices for Implementing 2FA Properly

If you want MFA that actually improves security (not just ticks a compliance box), follow these principles:

✅ Enforce MFA Everywhere Possible

Email, VPN, cloud portals, remote access, admin roles — no exceptions.

✅ Use Conditional Access

Apply stronger authentication for:

• Privileged accounts
• External access
• High-risk sign-ins

✅ Secure Break-Glass Accounts

• Long, unique passwords
• Stored securely offline
• MFA where supported

✅ Educate Users About Push Attacks

Teach users:

“If you didn’t try to log in, don’t approve.”

✅ Pair MFA with Strong Password Hygiene

MFA is not a replacement for:

• Unique passwords
• Password managers
• Regular credential audits

Why Every IT Professional Should Be an MFA Advocate

At this point, not using MFA is equivalent to:

• Leaving RDP open to the internet
• Running unsupported operating systems
• Ignoring patching

It’s no longer a “nice to have” — it’s baseline security.

Whether you’re protecting:

• A personal email account
• A small business tenant
• A multi-national enterprise

Two-factor authentication dramatically reduces risk with minimal overhead when done right.

Final Thoughts

Passwords alone are no longer sufficient in a world of phishing-as-a-service, leaked credential databases, and automated attacks.

Two-Factor Authentication isn’t perfect — but it is one of the most effective, low-cost security controls available today.

If you’re serious about protecting accounts, data, and users, MFA should be enabled by default — not after an incident.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.