How effective is multifactor authentication at deterring cyberattacks?

Lucas Augusto Meyer,Sergio Romero,Gabriele Bertoli,Tom Burt,Alex Weinert,Juan Lavista Ferres
2023-05-02
Abstract:This study investigates the effectiveness of multifactor authentication (MFA) in protecting commercial accounts from unauthorized access, with an additional focus on accounts with known credential leaks. We employ the benchmark-multiplier method, coupled with manual account review, to evaluate the security performance of various MFA methods in a large dataset of Microsoft Azure Active Directory users exhibiting suspicious activity. Our findings reveal that MFA implementation offers outstanding protection, with over 99.99% of MFA-enabled accounts remaining secure during the investigation period. Moreover, MFA reduces the risk of compromise by 99.22% across the entire population and by 98.56% in cases of leaked credentials. We further demonstrate that dedicated MFA applications, such as Microsoft Authenticator, outperform SMS-based authentication, though both methods provide significantly enhanced security compared to not using MFA. Based on these results, we strongly advocate for the default implementation of MFA in commercial accounts to increase security and mitigate unauthorized access risks.
Cryptography and Security
What problem does this paper attempt to address?
This paper aims to study the effectiveness of multifactor authentication (MFA) in preventing unauthorized access to business accounts, especially for those accounts with known credential leakage. The research evaluated the security performance of different MFA methods in a large Microsoft Azure Active Directory user dataset by using the benchmark multiplier method and manual account review. The research results show that MFA implementation provides excellent protection. More than 99.99% of the accounts with MFA enabled remained secure during the investigation period. In addition, MFA reduced the risk of being attacked by 99.22% in the entire group and by 98.56% in the case of credential leakage. The study also found that dedicated MFA applications (such as Microsoft Authenticator) perform better than SMS - based authentication, although both significantly enhance security compared to not using MFA. Based on these results, the author strongly recommends enabling MFA by default in business accounts to improve security and mitigate the risk of unauthorized access.