MFA Fatigue And The Associated Dangers

MFA fatigue, or multi-factor authentication fatigue, is an increasing concern for businesses like Peak Technologies and the clients that we provide Managed IT Support to. This phenomenon arises when users become overwhelmed by repeated authentication requests, leading to frustration and potential security risks. The danger of MFA fatigue is that an end user may allow a malicious individual access to their account on accident.

As organizations prioritize cybersecurity, effective implementation of MFA is crucial; however, excessive prompts can cause users to bypass essential security measures or compromise their login details.

It goes like this.

Hacker John obtains a username and password for a account that is protected with MFA. How they obtain it is a subject for another blog post but it can be a plethora of ways. (Even as simple as OH it's on the post-it note on my computer screen and the cleaning person put 2 and 2 together.)

Anyway Hacker John attempts to log in to the account using the obtained credentials and they are asked to confirm access via MFA. The MFA request still goes to the end users phone or mobile device to confirmed and login to the account approved.

The user receiving those MFA prompts may have become lax on understanding it and they get requests so often that they don't really think about what may be happening and just blindly approve the request thus granting Hacker John access to the account and all the data within it.

To mitigate MFA fatigue, Peak Technologies recommends adopting adaptive authentication strategies and user education, ensuring clients can benefit from enhanced security without diminishing user experience. By striking this balance, businesses can maintain robust defenses against cyber threats while fostering user satisfaction.

The bottom line is we are all a human firewall against malicious actors in the IT realm. Confirming all MFA request before you click on approval or scan your face on the MFA app is critical in the defense of your data.

I always tell users to click on deny or this was not me if you ever have any doubt about the request. The worst thing that will happen is you launch you Outlook or MS Teams and are logged out and get prompted again and now you are positive the request is for legitimate actions and not a Hacker John.