www.cisa.gov Open in urlscan Pro
2a02:26f0:3500:891::447a  Public Scan

Form analysis
2 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

Skip to main content

An official website of the United States government

Here’s how you know

Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.


Cybersecurity & Infrastructure Security Agency
America's Cyber Defense Agency

Search

×

search
 

Menu
Close
×

search
 

 * Topics
   Topics
   Cybersecurity Best Practices
   Cyber Threats and Advisories
   Critical Infrastructure Security and Resilience
   Election Security
   Emergency Communications
   Industrial Control Systems
   Information and Communications Technology Supply Chain Security
   Partnerships and Collaboration
   Physical Security
   Risk Management
   How can we help?
   GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
   TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
   LocallyFaith-Based CommunityExecutives
 * Spotlight
 * Resources & Tools
   Resources & Tools
   All Resources & Tools
   Services
   Programs
   Resources
   Training
   Groups
 * News & Events
   News & Events
   News
   Events
   Cybersecurity Alerts & Advisories
   Directives
   Request a CISA Speaker
   Congressional Testimony
 * Careers
   Careers
   Benefits & Perks
   HireVue Applicant Reasonable Accommodations Process
   Hiring
   Resume & Application Tips
   Students & Recent Graduates
   Veteran and Military Spouses
   Work @ CISA
 * About
   About
   Culture
   Divisions & Offices
   Regions
   Leadership
   Doing Business with CISA
   Site Links
   Reporting Employee and Contractor Misconduct
   CISA GitHub
   2023 Year In Review
   Contact Us

Report a Cyber Issue
America's Cyber Defense Agency
Breadcrumb
 1. Home

Share:




MORE THAN A PASSWORD

Protect Yourself from Malicious Hackers with Multifactor Authentication



Report a Cyber Issue
Organizations should report anomalous cyber activity and or cyber incidents 24/7
to report@cisa.gov or (888) 282-0870.


EVER WORRY ABOUT GETTING HACKED? SAME…

Your password isn’t protecting you the way you think it is. Especially if
someone can guess your password from looking at your social media. But let’s say
you have a complex password – or a password manager even – unfortunately
malicious cyber actors still have ways to get past your password. And once
they’re in your accounts… you can wave bye-bye to your money, and possibly your
identity.

So, what do you need? More than a Password! A second method to verify your
identity.

Multifactor authentication (MFA) can make you much more secure. Taking the extra
step beyond just a password can protect your business, online purchases, bank
accounts, and even your identity from potential hackers.

Different ways to say MFA:

 * Multifactor Authentication
 * Two Step Authentication
 * 2-Step Verification
 * Two Factor Authentication
 * 2FA


WHAT IS MULTIFACTOR AUTHENTICATION?

Prove it’s you with two! … Two step authentication, that is. 

MFA is a layered approach to securing your online accounts and the data they
contain. When you enable MFA in your online services (like email), you must
provide a combination of two or more authenticators to verify your identity
before the service grants you access. Using MFA protects your account more than
just using a username and password.  

Users who enable MFA are significantly less likely to get hacked. Why? Because
even if a malicious cyber actor compromises one factor (like your password),
they will be unable to meet the second authentication requirement, which
ultimately stops them from gaining access to your accounts.

Online services want to make sure you are who you say you are, and—more
importantly—they want to prevent unauthorized individuals from accessing your
account and data. So, they are taking a step to double check. Instead of asking
you just for something you know (e.g., a password)—which can be reused, more
easily cracked, or stolen—they can verify it’s you by asking for another piece
of information:


THEY’LL ASK FOR:


SOMETHING YOU KNOW

Like a PIN number or a password


SOMETHING YOU HAVE

Like an authentication application or a confirmation text on your phone


SOMETHING YOU ARE

Like a fingerprint or face scan


A MESSAGE FROM DIRECTOR EASTERLY


CISA Director Jen Easterly discusses enabling MFA.(link is external)
prevnext
slide 1 of 1


2 LEGIT TO QUIT - ENABLE MULTI-FACTOR-AUTHENTICATION (MFA) TODAY! (LINK IS
EXTERNAL)




HOW DO I ENABLE MFA?

Now that you know what it is, you’ll see prompts for multifactor authentication
all over. So whenever available, be sure to opt in.  

Start by looking at the security settings on your most-used accounts. You may
see options to enable MFA listed as “Two Factor Authentication,” “Multifactor
Authentication,” or “Two Step Factor Authentication.” There are many ways you
may be asked to provide a second form of authentication.  

Popular forms of MFA include: 

 * Text message (SMS) or voice message

 * Application-based MFA 

 * Phishing-resistant MFA 

 * Fingerprint authentication or face scan

Where to implement MFA: 

 * Email accounts 

 * Financial services 

 * Social media accounts 

 * Online stores 

 * Gaming and streaming entertainment services 

If you don’t see a prompt for multifactor authentication on one of these
accounts, send a note to each company asking them to enable the feature. After
all, it’s your security at stake! 

slide 1 of 2

Implementing MFA can make you 99% less likely to get hacked, according to
Microsoft.

MFA uses a combination of something you have and something you know or something
you are to confirm you are who you say you are online.




WHY SHOULD MY ORGANIZATION ENABLE MFA?

Implementing MFA makes it more difficult for a threat actor to gain access to
information systems—such as remote access technology, email, and billing
systems—even if passwords are compromised through phishing attacks or other
means.

Malicious cyber actors are increasingly capable of phishing or harvesting
passwords to gain unauthorized access. They take advantage of passwords you
reused on other systems. MFA adds a strong protection against account takeover
by greatly increasing the level of difficulty for bad actors.

Are you an organization that needs help getting started implementing MFA? 

Capacity Enhancement Guide: Implementing Strong Authentication (PDF, 861.52 KB )


WHAT ELSE SHOULD I KNOW ABOUT MFA?

Not all MFA methods gives you the same level of protection. Some MFA types are
better than others—phishing-resistant MFA is the standard all industry leaders
should strive for, but any MFA is better than no MFA. You should still strive to
implement stronger MFA to avoid being hacked.

 * The only widely available phishing-resistant authentication is FIDO/WebAuthn
   authentication. CISA urges all organizations to start planning a move to FIDO
   because when a malicious cyber actor tricks a user into logging into a fake
   website, the FIDO protocol will block the attempt. See CISA Fact
   Sheet Implementing Phishing-Resistant MFA, CISAJen(link is external)’s
   blogpost Next Level MFA: FIDO authentication, and the Fido Alliance’s How
   Fido Works(link is external) for more information.
 * If you can’t currently implement phishing-resistant MFA, consider using
   numbers matching MFA to block mobile push bombardment and SMS-based attacks.
   See CISA Fact Sheet Implementing Number Matching in MFA Applications for more
   information.

For additional information on recommended forms of MFA, see CISA’s MFA hierarchy
graphic, which sorts all the MFA types into tiers (strongest to weak).




MFA TOOLKIT

We need your help! Use our materials on your social media accounts and internal
emails to help us encourage others to enable MFA.

Download here

 

Return to top
 * Topics
 * Spotlight
 * Resources & Tools
 * News & Events
 * Careers
 * About

Cybersecurity & Infrastructure Security Agency
 * Facebook
 * Twitter
 * LinkedIn
 * YouTube
 * Instagram
 * RSS

CISA Central 888-282-0870 central@cisa.dhs.gov(link sends email)
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
 * About CISA
 * Accessibility
 * Budget and Performance
 * DHS.gov
 * FOIA Requests
 * No FEAR Act
 * Office of Inspector General
 * Privacy Policy
 * Subscribe
 * The White House
 * USA.gov
 * Website Feedback