MFA (Multi-Factor Authentication) is the practice of requiring two or more independent factors to authenticate a user: something you know (a password), something you have (a phone, token, smartcard), something you are (biometrics, fingerprint, facial recognition). Two factors (2FA) is the modern minimum; three factors (3FA) is common in high-security contexts.
The value of MFA is in blocking attacks based on leaked credentials alone. An attacker who obtains a password (through phishing, a database breach, or a brute-force attack) still needs the second factor, typically out of remote reach. Microsoft studies show that MFA blocks 99%+ of automated account-compromise attacks.
Recommended practices have evolved. SMS as a second factor was considered secure for years; today it is discouraged for critical accounts due to SIM swapping. Authenticator apps (Microsoft Authenticator, Google Authenticator) and hardware keys (YubiKey, FIDO2) are the recommended options. INFOS implements corporate MFA aligned with ISO 27001 for its customers, with integration into Entra ID, Active Directory and SSO.