# Password Security and MFA: Strong Passwords, Password Managers and Multi-Factor Authentication

**URL:** https://securesys.com.tr/en/learning/end-user-security/password-security-and-mfa

![Password Security and MFA: Strong Passwords, Password Managers and Multi-Factor Authentication](/images/bilgi-merkezi/covers/cover-sonkullanici-04.webp)

One of the most important digital assets a user has in order to be able to reach corporate systems is their identity.

An important part of the e-mail account, VPN access, corporate applications, cloud services, file sharing systems and finance applications works through the user identity. For this reason the goal of cyber attackers is not always to find a technical weakness on a server.

Sometimes there is a far easier path:

**Taking over the user account.**

When an attacker obtains a valid username and password they can at first sight be seen by the system as a normal user. Particularly if additional controls such as Multi-Factor Authentication (MFA), Conditional Access, device compliance and behavioral monitoring are not present, a stolen password can turn directly into an Account Takeover event.

For this reason in modern identity security the fundamental question is no longer only:

**"Is your password strong?"**

it is not this.

The real question is this:

**"If your password is captured, which other security layers will protect your account?"**

For this reason the modern Password Security and Authentication Security approach must be built on this structure:

**Unique Password + Password Manager + MFA + Phishing-Resistant Authentication + Conditional Access + Identity Monitoring**

The password is still important.

However, it must no longer be the only line of defense.

### What Is Password Security?

**Password security, or Password Security, is the security approach that provides protection for user accounts against being guessed, broken, captured or reused on other systems.**

A good password security policy does not consist only of asking the user to use uppercase letters, lowercase letters, numbers and special characters.

In modern password security;

password length,

uniqueness,

password reuse,

the use of a password manager,

compromised password detection,

MFA,

authentication monitoring

and account recovery processes

must be evaluated together.

Because the attacker does not necessarily have to break the password with a brute-force method.

The password can be obtained from a phishing attack, from malware, from an infostealer, from another data breach event or from a credential theft attack.

Therefore a strong password policy must mean not only:

**"Creating a password that is difficult to break"**

but,

**"Making it difficult for the attack to progress even if the password is captured"**

it must mean this.

### How Is a Strong Password Created?

"How is a strong password created?" is one of the questions users most frequently ask about password security.

One of the most important elements for a strong password is length. A very short password looking complex may not be enough on its own. Longer, unique passwords that are difficult to guess generally provide a stronger approach.

Here it is particularly important to avoid personal information.

A first name, surname, company name, date of birth, telephone number, team name or easily guessable words must not be used inside a password.

Similarly:

**Company2026!**

passwords such as this, which appear to meet the complexity requirement but use a guessable pattern, must not be considered strong.

The real aim is not to produce complex combinations that are difficult for the user to memorize but to make it difficult for the attacker to guess it or to obtain it from different sources.

### Why Is Password Length Important?

Password length is one of the fundamental elements of password security.

As the length of the password increases the number of possible combinations increases and the cost of brute-force attacks rises. However, thinking only in terms of length here is not correct either.

For example a very long but generally known sentence can still be risky if it is present in a leaked password list.

For this reason the three fundamental characteristics of password security:

**Length + Uniqueness + Unpredictability**

can be thought of as these.

### What Is a Passphrase?

A passphrase is the approach of using a longer combination of words or an expression as a password instead of a single short password.

The aim is to create a longer authentication secret that the user can remember but that is difficult for the attacker to guess.

However, popular film lines, song lyrics, proverbs or expressions easily found on the internet must not be used directly as a passphrase.

The passphrase approach can provide a length advantage in particular, but in a corporate environment the use of a password manager can be a more scalable solution.

### What Is Password Complexity?

Password complexity expresses the password containing different character groups.

For example:

uppercase letters,

lowercase letters,

digits,

special characters

requirements such as these can be applied.

However, complexity on its own does not mean a strong password.

Users can develop guessable patterns in the face of a very strict complexity policy.

For example adding only the year or an exclamation mark to the end of the existing password may not increase real security to the expected extent.

For this reason in modern password policy design, length, uniqueness and compromised password checking must be evaluated together with complexity.

### What Is Password Reuse and Why Is It Dangerous?

Password reuse is the same password being used on more than one account or service.

This behaviour is one of the most critical risks in end user security.

For example if the user uses the same password on:

personal e-mail,

social media,

corporate e-mail

and another web service

then only one of these services being compromised can put the other accounts at risk too.

Attackers can automatically try username-password combinations obtained from other data breach events on different platforms.

This attack is called:

#### Credential Stuffing

as it is known.

### What Is Credential Stuffing?

Credential stuffing is previously captured username and password combinations being tried automatically on other online services.

Here the attacker does not try to break the password.

They already have a credential list in their hands.

They only test whether the same user information is valid on other platforms.

For this reason if the user:

**a very strong but everywhere the same password**

is using this, they are still under serious risk.

For this reason one of the most important principles in terms of password security:

**is the use of a unique password for each account.**

### What Is a Brute Force Attack?

A brute force attack is different password combinations being tried systematically in order to find the correct credential.

In online brute-force attacks controls such as rate limiting, account lockout, MFA and risk-based authentication can make the attack more difficult.

Offline password cracking, on the other hand, is a different risk model. If the attacker has obtained the password hash they can try to perform guessing at high speed on their own systems.

For this reason password storage security is also an important part of the authentication architecture.

### What Is Password Spraying?

Password spraying is a small number of common passwords being tried on a large number of user accounts.

While in a classic brute-force attack many passwords are tried on a single account, in a password spraying attack the attacker uses a few common passwords on a large number of accounts.

The aim is to obtain a credential without triggering the account lockout mechanisms.

For example in corporate environments guessable initial passwords or common patterns can increase the password spraying risk.

For this reason default password, temporary password and initial password processes must be designed securely.

### Why Is a Default Password a Big Security Risk?

The use of a default password on newly created user, device or application accounts can create serious risk.

Particularly if the default credential is left unchanged the attacker can reach the system without using any vulnerability.

Default passwords need to be changed at first use and if possible the temporary credential needs to be short-lived.

### How Should a Temporary Password Be Managed?

A temporary password is the temporary credential given to the user for the first authentication.

This password must not be valid for a long time and if possible it must be changed after the first login.

In addition the temporary password remaining permanently in an e-mail or an open messaging channel creates a separate risk.

In corporate onboarding processes temporary credential delivery must be designed securely.

### Does Password Expiration Always Increase Security?

In the past users changing their passwords very frequently was a widespread security approach.

However, very frequent mandatory password changes can cause users to create guessable patterns.

For example the user:

Password01!

Password02!

Password03!

can progress in this way.

For this reason the password rotation policy must be evaluated together with the organization's risk model, the authentication infrastructure it uses and the relevant security standard requirements.

Particularly if there is a suspicion of compromise the password change must be made without delay.

### What Is a Compromised Password?

A compromised password is a password that has previously been exposed as a result of a data breach, malware or another attack.

Even if the user's password is theoretically strong, if it is present in known leaked credential lists it must not be used.

In modern identity security systems:

#### Compromised Password Detection

or the use of breached password checking is valuable for this reason.

The aim is to prevent users from using passwords the attackers already know.

### What Is a Password Manager?

A password manager is the application or service class that allows users to create, store and, when necessary, securely use unique and strong passwords for different accounts.

One of the biggest advantages of using a password manager is that users do not have to memorize dozens of different passwords.

In this way a different and long credential can be used for each service.

This approach helps to reduce the password reuse and credential stuffing risks seriously.

### Is a Password Manager Secure?

The use of a password manager generally provides a strong password security approach when it is configured correctly.

However, the password manager itself also becomes a critical security asset.

For this reason for the password vault:

a strong master password,

MFA,

device security,

a secure recovery process

and a trusted provider

are important.

In corporate environments, instead of users using random personal password manager services, preferring an organization-approved password management solution can be more correct.

### What Is a Master Password?

The master password is the main credential that provides access to the password vault.

This password must be particularly strong and unique.

It must not be used on any other account.

Since a large number of credentials can be at risk when the master password is compromised, the use of MFA is also important.

### Can a Password Manager Help Against Phishing?

Yes.

A password manager is not only a password storage tool; it can also provide an additional security signal against the phishing risk.

For example the credential registered for the real corporate login domain may not be suggested automatically on a lookalike phishing domain.

If the user notices that the password that is normally autofilled unexpectedly does not appear they can check the URL again.

For this reason a password manager:

#### Password Security + Anti-Phishing

can be evaluated together in these terms.

### **What Is MFA? How Does Multi-Factor Authentication Work?**

**MFA, that is Multi-Factor Authentication, is the user identity being verified using more than one independent authentication factor.**

In Turkish:

#### Çok Faktörlü Kimlik Doğrulama

it is used as this.

In the classic username-password model if the attacker captures the password they can reach the account.

MFA, on the other hand, aims for the password information alone not to be sufficient by adding a second verification layer.

For this reason MFA is today one of the most important security controls in terms of Identity Security and Account Takeover Prevention.

### What Are the Types of Authentication Factor?

Authentication factors can generally be separated into three main categories.

**Something You Know: Information such as a password or a PIN that the user knows.**

**Something You Have: Tools such as a telephone, an authenticator, a token or a hardware security key that the user possesses.**

**Something You Are: Biometric characteristics such as a fingerprint or face recognition.**

For real Multi-Factor Authentication it is important that different factor categories are used together.

Asking for two different passwords does not mean two-factor authentication; both are in the same "something you know" category.

### What Is the Difference Between 2FA and MFA?

**2FA, Two-Factor Authentication, expresses exactly two different authentication factors being used.**

MFA, on the other hand, is the broader term that covers two or more factors being used.

In daily use 2FA and MFA can sometimes be used interchangeably.

However, technically MFA is a broader concept.

### Why Is MFA Important?

The password may have been captured as a result of phishing, a data breach or malware.

If MFA is present the attacker cannot log in with the password alone.

This is of critical importance particularly for:

E-mail Security,

VPN Security,

Cloud Security,

Remote Access Security,

Privileged Access Security

for these.

However, the presence of MFA does not mean that the account is completely secure.

Because not all MFA methods provide the same security level.

### What Are the MFA Methods?

MFA can be applied with different technologies.

SMS OTP,

E-mail OTP,

TOTP Authenticator,

Push Notification,

Hardware Token,

FIDO2 Security Key,

Passkey

are some of these.

The level of protection these methods provide against phishing resistance and the account takeover risk differs from one another.

For this reason organizations need to ask not only:

**"Is MFA on?"**

this question but,

**"Which MFA method is being used?"**

this question as well.

### What Is SMS MFA?

SMS MFA is a single-use verification code being sent to the user's telephone during authentication.

It provides an important additional security layer compared with password-only authentication.

However, SMS-based verification has some risks.

Scenarios such as telephone number manipulation, social engineering or the OTP code being obtained from the user through phishing can be evaluated.

For this reason on high-risk accounts stronger phishing-resistant authentication methods can be preferred.

### What Is OTP?

OTP:

#### One-Time Password

is the temporary verification code created for a single use.

The advantage of an OTP is that the same code is not used continuously like a permanent password.

However, if the user enters the OTP code into a phishing site the attacker can try to use it quickly inside the real authentication flow.

Therefore using an OTP does not completely eliminate the phishing risk.

### What Is TOTP?

TOTP:

#### Time-Based One-Time Password

is the authentication method that produces a verification code that changes at certain time intervals.

It is widely used in authenticator applications.

Not being dependent on SMS can be an important advantage.

However, the TOTP code can also be entered into a phishing site by the user.

For this reason even though TOTP provides a strong MFA layer it is not completely phishing-resistant.

### What Is Push Notification MFA?

Push MFA is an approval notification being sent to the authenticator application on the user's telephone when a login attempt takes place.

The user can approve or deny the operation.

The ease of use is high but if the user approves unexpected notifications without thinking the attack can succeed.

This risk is related to:

#### MFA Fatigue

or

#### MFA Bombing

these attacks.

### What Is MFA Fatigue?

MFA fatigue is the attacker trying to make the user finally approve the request by sending MFA approval notifications again and again.

The user:

"Maybe it is something systemic."

or

"Let the notifications stop now."

can approve by mistake with this thought.

The important part of this attack is not technical but social engineering based.

For this reason an unexpected MFA notification:

**a security incident indicator**

must be evaluated as this.

### What Should the User Do If They Receive an MFA Notification They Were Not Expecting?

First of all they must not approve the request.

Then they must report the event to the IT or SOC team according to the organization's security reporting process.

An unexpected MFA request can be an important signal that the attacker may already know the user's password.

Therefore not only rejecting the notification but also checking the account activity may be necessary.

### What Is Number Matching?

Number matching is the MFA mechanism that requires a number shown on the login screen to be verified on the authenticator application.

The aim is to make it difficult for the user to approve any push notification without thinking.

This method can help to reduce the MFA fatigue risk.

However, if the user is actively following the attacker's directions inside a phishing flow it does not prevent all phishing scenarios on its own.

### What Is Phishing-Resistant MFA?

Phishing-resistant MFA is the stronger authentication approach aimed at preventing the authentication credential from being easily reused through a fake website or an attacker-controlled intermediary.

Among the most important technologies in this area are:

#### FIDO2

and

#### WebAuthn

these are found.

These technologies use public-key cryptography instead of a shared secret and can associate the authentication operation with the correct service/domain.

For this reason compared with a classic OTP or push MFA they can provide stronger protection against phishing attacks.

### What Is FIDO2?

FIDO2 is the open standard family used for passwordless and phishing-resistant authentication.

In the FIDO2 approach the private key part of the user credential remains on the authenticator.

On the service side, on the other hand, the public key is found.

During authentication the private key is not sent directly to the server.

This structure helps to reduce the credential phishing and credential replay risks.

### What Is WebAuthn?

WebAuthn is the web standard that allows web applications to use public-key based authentication.

By working together with the browser and the operating system it can provide strong authentication over a hardware security key or a platform authenticator.

WebAuthn is one of the fundamental technologies of modern Passwordless Authentication and Passkey architectures.

### What Is a Hardware Security Key?

A hardware security key is a physical authentication device.

It can be used with connection methods such as USB, NFC or similar.

Security keys that support FIDO2/WebAuthn are particularly valuable for phishing-resistant authentication in terms of privileged users, administrators and high-risk users.

Because even if the attacker knows the password it becomes difficult for them to perform authentication without the physical authenticator.

### What Is a Passkey?

A passkey is the modern authentication credential approach that uses public-key cryptography instead of a password.

During authentication the user can use local verification such as biometrics or a PIN on the device.

However, a classic reusable password is not sent to the remote service.

For this reason the passkey approach:

password reuse,

credential stuffing,

phishing

has the potential to reduce traditional password attacks such as these.

### What Is the Difference Between a Passkey and a Password?

A password is a secret known between the user and the service.

A passkey, on the other hand, uses asymmetric cryptography.

While the service stores the public key the private key is protected on the authenticator side.

For this reason on the server side there is no classic password the attacker can use directly.

### What Is Passwordless Authentication?

Passwordless authentication is the general name for the methods in which the user authenticates without entering a classic password.

A passkey,

a FIDO2 security key,

certificate-based authentication

methods such as these can be parts of this approach.

Passwordless does not mean that the authentication is without factors.

On the contrary strong device possession and local user verification can be used.

### Is the Future of Passwords the Passkey?

Passkey and FIDO2 based authentication is becoming increasingly important.

However, in corporate environments, because of legacy applications, device compatibility, account recovery and business requirements, passwords disappearing completely in a short time may not be possible in every environment.

For this reason for many organizations the realistic approach:

**Password Security → Strong MFA → Phishing-Resistant MFA → Passwordless**

can be a gradual transformation in this form.

### Does MFA Prevent Every Phishing Attack?

No.

This is a critical point.

Users sometimes:

**"If there is MFA, phishing is no longer a problem."**

can think in this way.

However, modern phishing attacks can target the whole authentication flow.

For example the attacker can try to obtain the OTP code in real time together with the user's password.

In more advanced attacks the authenticated session information can be targeted.

For this reason, although MFA is a very strong control, on its own it does not solve all Identity Attack scenarios.

### What Is Adversary-in-the-Middle Phishing?

**Adversary-in-the-Middle or AiTM Phishing is the phishing class in which the attacker tries to capture the credential and session information by placing an intermediate layer in the authentication flow between the user and the legitimate authentication service.**

While the user performs authentication over the fake interface the attacker can transfer the information to the real service.

When the authentication is completed information such as the session token can be targeted.

For this reason in modern identity security not only password and OTP security but:

#### Session Security

is also important.

### What Is a Session Token?

A session token is the information that allows the user to continue their authenticated session after authentication without entering their password again and again.

If this token is captured by the attacker, in some scenarios session abuse can be possible without the password or MFA being asked for again.

This attack:

#### Session Hijacking

or

#### Token Theft

can be associated with these.

### Why Is Session Security After MFA Important?

MFA strengthens the moment of authentication.

However, if the session created after the authentication is not sufficiently protected the attacker can target a different stage.

For this reason the modern authentication architecture:

**Password → MFA → Session → Continuous Verification**

must protect the whole of this chain.

### What Is an Infostealer and How Does It Threaten Passwords?

An infostealer is the malware class that aims to collect browser credentials, cookies, tokens and other sensitive information over the endpoint.

For this reason even if the user has never entered their password into a phishing site, credentials or session data can be exposed over a compromised endpoint.

This situation shows why Password Security and Endpoint Security cannot be thought of separately from each other.

EDR, browser hardening, application control and patch management are for this reason also parts of identity protection.

### What Is Account Takeover?

**Account Takeover or ATO is the attacker obtaining unauthorized control over a legitimate user account.**

As a result of ATO the attacker:

can read e-mail,

can reach cloud files,

can send messages to internal users,

can perform a password reset,

can manipulate business processes.

Corporate e-mail account takeover events in particular can be the starting point of BEC and lateral phishing attacks.

### How Can an Identity Attack Chain Progress?

An example of a modern identity attack can progress in this way:

#### Phishing

↓

#### Credential Theft

↓

#### MFA Manipulation

↓

#### Account Access

↓

#### Session Abuse

↓

#### Internal Access

↓

#### Data Theft / Fraud

For this reason identity security is not only protecting the login screen.

The behaviour after authentication also needs to be monitored.

### What Is Conditional Access?

Conditional access is authentication and authorization decisions being made not only according to the correct password or MFA information but according to additional security context.

For example:

user identity,

device compliance,

location,

application,

login risk,

session risk

can be evaluated.

In this way even if the correct credential is used a risky login attempt can be blocked or additional authentication can be requested.

### Why Is Device Compliance Important?

The user's identity may be correct but the device they use may not be secure.

For example the endpoint:

without EDR,

without patches,

rooted,

unmanaged

can be in these states.

For this reason in the Zero Trust approach not only:

**"Who is the user?"**

but,

**"Which device are they coming from?"**

this question is also asked.

### What Is Risk-Based Authentication?

Risk-based authentication is the authentication requirement being changed according to the risk level calculated during login.

A normal user + a known device + a normal location can be evaluated as low risk.

However:

a new device,

an unusual location,

impossible travel,

malicious IP reputation,

abnormal behaviour

signals such as these can raise the risk level.

In a high risk situation access can be blocked or stronger authentication can be requested.

### What Is Impossible Travel?

Impossible travel is the same user appearing to have performed authentication from very distant locations within a time too short to be physically possible.

This situation can be a credential compromise signal.

However, since a false positive can occur because of a VPN, a proxy or cloud infrastructure it is not definite proof of compromise on its own.

### Identity Protection and SIEM Integration

Authentication security must not be left only on the Identity Provider.

Login logs,

MFA events,

password changes,

new device registrations,

session activity,

privileged access events

can be sent to central security monitoring systems such as the SIEM.

In this way, by correlating different signals, Account Takeover can be detected more quickly.

### An Example of Identity Correlation

For one user:

a successful phishing report,

then an unusual login,

a new MFA device registration,

and afterwards a mailbox forwarding rule

if these are seen, these events must be handled within the same incident context instead of being evaluated separately.

The SIEM and the SOC at this point form the operational layer of Identity Security.

### The Relationship Between EDR and Identity Security

A credential attack may not take place only on the identity platform.

The attacker may have run an infostealer on the endpoint.

For this reason when a suspicious login is seen the EDR telemetry of the relevant endpoint must also be examined.

Similarly when EDR detects credential dumping or suspicious browser access the identity team can evaluate the active sessions.

This integration:

#### Identity + Endpoint Security

is the basis of this approach.

### Can NDR See Identity Attacks?

NDR may not see directly that the password has been stolen.

However, if lateral movement is performed inside the network using a compromised account, unusual SMB, RDP, authentication or server access behaviours can be seen.

For this reason a modern Account Takeover investigation:

Identity

Endpoint

Network

requires this telemetry to be evaluated together.

### Password Reset Security

Password reset is a critical identity process attackers can target with social engineering.

If the attacker can have a password reset performed by deceiving the help desk, a strong password policy can become ineffective.

For this reason during a password reset identity verification, audit logging and risk-based approval mechanisms must be applied.

### Why Is Account Recovery Critical?

Account recovery is the process that allows the user to reach their account again when they lose their authentication factors.

If this process is designed too easily it can be abused by the attacker.

If it is designed too strictly the user cannot reach the business service.

For this reason the recovery mechanism:

**Secure + Auditable + Usable**

must be this.

### MFA Reset Security

When the user loses their telephone or loses access to the authenticator an MFA reset may be needed.

However, the attacker can use the same story.

For this reason the help desk:

"I changed my phone."

must not accept this expression as sufficient verification on its own.

An MFA reset must be evaluated as a high-risk identity event and strong verification must be applied.

### Why Should New MFA Device Registration Be Monitored?

The attacker can add their own authenticator device to a compromised account.

In this case even if the password changes the attacker can try to obtain access over the new authentication method.

For this reason:

a new authentication method,

a new security key,

a new recovery method

changes such as these must be brought within the scope of monitoring.

### Privileged Account Security

Administrator accounts carry a higher risk than normal user accounts.

Because in the case of a compromise the attacker can obtain far broader access.

For privileged accounts:

phishing-resistant MFA,

PAM,

a separate admin account,

a Privileged Access Workstation,

strong session monitoring

additional controls such as these can be applied.

### Should the Admin Account Be Used in Daily Work?

As far as possible, no.

Using a privileged account to read e-mail, to browse the web or for daily office work increases the attack surface.

The administrator's normal user account and privileged accounts being separated is a more secure model.

### Service Account Password Security

Service accounts carry different risks from user accounts.

Their passwords can remain unchanged for a long time and they can be used on many systems.

For this reason for service account security:

managed identity,

secret management,

credential rotation,

least privilege

approaches such as these must be evaluated.

Applying the human user password policy directly to service accounts may not always be correct.

### Why Is a Shared Account Risky?

More than one person using the same username/password leads to an accountability problem.

When a security event occurs it may not be possible to determine which person performed the operation.

In addition when an employee leaves, changing the shared password can be forgotten.

For this reason individual identity and named accounts must be used as far as possible.

### Why Is Authentication Logging Important?

Strong authentication must not only control access but must at the same time be traceable.

Among the important logs:

successful login,

failed login,

MFA failure,

password reset,

MFA registration,

account lockout,

session creation

can be found.

By these events being analyzed by the SIEM and the SOC, identity attacks can be detected more quickly.

### What Is an Authentication Baseline?

Every user's normal authentication behaviour can be different.

The user's normal:

login hours,

devices,

locations,

applications

patterns can form a baseline over time.

Serious deviations from this baseline can be a security signal for investigation.

### Zero Trust and Password Security

The Zero Trust approach does not give the user unlimited trust just because the correct password has been entered.

Authentication is only the starting point.

In the Zero Trust model:

Identity

Device

Context

Resource

Risk

are evaluated together.

For this reason a strong password is only one control within the Zero Trust architecture.

### What Is Continuous Authentication?

Continuous authentication or continuous verification is risk signals continuing to be evaluated throughout the session after the user has authenticated.

For example the login can be normal at the beginning.

However, if during the session:

impossible behaviour,

an increase in device risk,

malware detection,

unusual data access

are seen, the access can be re-evaluated.

The direction of modern Identity Security is for this reason:

#### One-Time Authentication

from this model

#### Continuous Trust Evaluation

it is progressing towards this model.

### The Most Frequently Made Mistakes in Password and MFA Security

The important mistakes frequently encountered in organizations are these:

- Allowing the same password to be used on more than one system
- Using a very short password
- Creating guessable password patterns
- Not changing default passwords
- Using shared accounts
- Not standardizing the use of a password manager
- Using MFA only on the VPN
- Not applying MFA on critical cloud applications
- Not using strong MFA for privileged accounts
- Seeing SMS or push MFA as sufficient for all risks
- Not explaining the MFA fatigue risk to the user
- Not evaluating phishing-resistant MFA
- Leaving legacy authentication open
- Leaving the password reset processes weak
- Not verifying MFA reset operations sufficiently
- Not monitoring new MFA registration events
- Not monitoring active sessions
- Only changing the password after a password compromise
- Not performing session/token revocation
- Not sending the identity logs to the SIEM
- Not putting the account recovery processes through a security test

### Password Security and MFA Checklist

In a corporate Authentication Security evaluation the following questions can be asked:

- Does every user use a unique password?
- Is the minimum password length sufficient?
- Is compromised password checking being performed?
- Is password reuse being limited?
- Is an approved password manager being used?
- Have shared accounts been reduced?
- Have default credentials been removed?
- Are temporary passwords being managed securely?
- Is MFA active on all critical systems?
- Is remote access protected with MFA?
- Do privileged accounts use MFA?
- Has phishing-resistant MFA been evaluated?
- Is FIDO2/WebAuthn support available?
- Is a passkey roadmap being evaluated?
- Are there controls such as number matching against MFA fatigue?
- Has legacy authentication been disabled?
- Is Conditional Access being applied?
- Is device compliance included in the authentication decision?
- Is risky login detection active?
- Is new MFA device registration being monitored?
- Are password reset events being logged?
- Does an MFA reset require strong verification?
- Is there active session revocation capability?
- Do the identity logs go to the SIEM?
- Is an Account Takeover playbook available for the SOC?

### Password and Identity Security Maturity Model

#### Level 1 - Password-Only Authentication

The organization's basic security model is built on the username and password. MFA is limited or not present.

This level carries a high risk against Credential Theft and Password Reuse attacks.

#### Level 2 - Strong Password + MFA

The password policy has been improved and MFA has been applied for critical applications.

The account takeover risk is reduced significantly but the authentication context is limited.

#### Level 3 - Identity-Aware Security

Conditional Access, device compliance, risky login detection and centralized identity monitoring are applied.

Authentication is not evaluated only through the password and MFA.

#### Level 4 - Phishing-Resistant Identity

For high-risk and privileged users, phishing-resistant authentication methods such as FIDO2, WebAuthn, a security key or a passkey are made widespread.

Session security and token risks are also monitored.

#### Level 5 - Adaptive Zero Trust Identity

Identity, device, behaviour, resource criticality and real-time risk are evaluated together.

Access is verified continuously and when the risk rises the session can be limited or ended automatically.

### Frequently Asked Questions

#### How is a strong password created?

A strong password must be long, unique and difficult to guess. The same password must not be used on different systems and if possible it must be managed with a trusted password manager.

#### What is password security?

Password security is the security controls applied against passwords being guessed, broken, stolen or reused on other systems.

#### What is a Password Manager?

A password manager is the application or service that allows strong and unique passwords for different accounts to be created and stored securely.

#### Is a Password Manager secure?

A correctly chosen and securely configured password manager can strengthen general account security by reducing the password reuse risk. Master password and MFA security are particularly important.

#### What is Password Reuse?

It is the same password being used on more than one account. When the credential of one account is exposed the other accounts can also come under risk.

#### What is Credential Stuffing?

It is previously captured username-password combinations being tried on different online services.

#### What is Password Spraying?

It is a small number of common passwords being tried on a large number of user accounts.

#### What is MFA?

MFA, Multi-Factor Authentication, is the user identity being verified with more than one independent authentication factor.

#### What is the difference between 2FA and MFA?

2FA uses exactly two authentication factors. MFA, on the other hand, is the broader concept that covers the use of two or more factors.

#### Why is MFA important?

Even if the password is captured it reduces the Account Takeover risk by requiring an additional authentication factor for the attacker to be able to reach the account.

#### Is SMS MFA secure?

It is stronger than password-only authentication but against phishing and some attack risks related to the telephone number, stronger phishing-resistant methods can be preferred.

#### What is TOTP?

Time-Based One-Time Password is the single-use verification code that changes at certain intervals in authenticator applications.

#### What is MFA Fatigue?

It is the attacker trying to obtain approval by mistake or as a result of pressure by sending a large number of MFA notifications to the user.

#### What is Phishing-Resistant MFA?

They are strong authentication methods such as FIDO2/WebAuthn that make it difficult for the authentication credential to be reused on phishing sites.

#### What is FIDO2?

It is the standard family that uses public-key cryptography and can provide phishing-resistant/passwordless authentication.

#### What is a Passkey?

It is the modern authentication credential approach that uses public-key cryptography instead of a classic password.

#### What is Passwordless Authentication?

It is the general name for the methods in which the user authenticates without entering a classic reusable password.

#### If there is MFA is a strong password necessary?

Yes. In the Defense in Depth approach the password and MFA are security layers that complement each other.

#### Does MFA completely prevent phishing?

No. Because of OTP phishing, MFA fatigue, session theft and some AiTM phishing attacks, additional identity security controls are needed.

#### What is Session Hijacking?

It is the authenticated user session information being captured by the attacker and used for unauthorized access.

#### What is Conditional Access?

It is the access decision being made according to context information such as user, device, location, application and risk.

#### What is Account Takeover?

It is the attacker obtaining unauthorized control over a legitimate user account.

### Conclusion: Modern Identity Security Is More Than Protecting the Password

For many years the fundamental advice of user security was:

**"Use a strong password."**

it was this.

This advice is still valid.

However, it is no longer sufficient.

Because attackers do not have to perform brute force only in order to obtain a password.

A credential;

phishing,

a data breach,

an infostealer,

credential stuffing,

social engineering

can be captured with many different methods such as these.

For this reason the first principle of modern Password Security:

**is to use a unique password.**

A password manager plays an important role here.

The second defense layer:

#### MFA

it must be this.

However, the presence of MFA is not sufficient on its own.

Organizations:

which MFA method they use,

the MFA reset process,

session security,

the conditional access policies,

the identity monitoring capability

need to evaluate these as well.

Particularly for high-risk users and privileged accounts:

#### Phishing-Resistant MFA

must become an important goal.

Technologies such as FIDO2, WebAuthn, a hardware security key and a passkey are important parts of the modern authentication security architecture.

However, even if the technology changes the fundamental principle does not change:

**Unlimited trust must not be given to a single credential.**

The modern Authentication Security chain must be thought of in this way:

#### Strong Identity

↓

#### Unique Credential

↓

#### MFA

↓

#### Device Verification

↓

#### Conditional Access

↓

#### Session Monitoring

↓

#### Continuous Verification

This structure at the same time forms the basis of the Zero Trust Identity approach.

From the end user's point of view the most important behaviours are quite clear:

Not using the same password on different systems.

Using a password manager.

Not approving unexpected MFA requests.

Not sharing the password or the OTP code.

Reporting suspicious authentication activity quickly.

From the organization's point of view, on the other hand, the goal must not be to make the user memorize ever more complex passwords.

The goal:

**is to make the authentication architecture resistant to human error**

it must be this.

For this reason the fundamental formula of modern identity security:

**Unique Password + Password Manager + MFA + Phishing-Resistant Authentication + Conditional Access + Identity Monitoring**

can be expressed in this form.

And the most important sentence of this chapter is this:

**A strong password is not the last line of defense protecting your account but only the first layer of the modern Identity Security architecture.**