This is a question that was raised from the Identity and Access exam, but it is still unclear to me why Multi Factor Authentication (MFA) would not cover all of these attacks and if I were to present a business case of what benefits or attacks would MFA prevent, I would not be able to confidently identify those based on the question that was raised.

The question was along the lines of:

MFA can prevent which of the two following attacks?

  • Dictionary
  • Keylogging
  • Man in the Middle
  • Network proximity
  • Phishing

Dictionary - MFA would prevent a dictionary attack because even if the dictionary attack successfully identified the username and password, MFA would prevent login.

Phishing - Someone can be still be phished for their crdentials but MFA would prevent stolen credentials from being used to access protected resources.

Keylogging - Similar to the dictionary attack, even if the username and password were logged, the MFA would prevent the protected resources from being accessed.

Man in the middle - MFA would prevent this because the second authentication factor would prevent login if the first verification was intercepted by the man in the middle. Unless double man in the middle?

Network proximity - Similar to man in the middle, even if there was whitelisting or some sort of network level protection to prevent access and the attacker was somehow in the network or coming from a range that was accidentally extended beyond what was approved, MFA (if enabled) would prevent the protected resources from being accessed.

From my perspective, all of the attacks could occur regardless if MFA was enabled, you could still be attacked with dictionary attempts, credentials could be keylogged, man in the middle could intercept tokens, and someone could use network proximity to perform an attack, but MFA from my perspective would prevent all of these from actually accessing the resources.

What considerations in regards to these attacks am I missing where MFA would not provide protection?

  • 5
    A courtesy to readers in all contexts is to explain an acronym on its first use e.g. "... why MFA (Multi-Factor Authentication) would ...". – Keith C Jul 2 at 17:57

It is Keylogging and Phishing. Because these other attacks can be avoided with different ways -

Dictionary attack This can be avoided by using complex password policies and a number of attempts. With Salesforce, in the session setting, you can configure same policies.

Man-in-the-middle attack This is more concerned related to network security than the password. With VPN/allowed IPs you can prevent the same.

Network proximity This is also more related to the network. Same as MITM(Man-In-The-Middle) attack, it can be prevented with network configurations.

Reference for Phishing - https://help.salesforce.com/articleView?id=000352937&language=en_US&mode=1&type=1

Reference for keylogging - https://enterprise.comodo.com/how-to-prevent-keylogging.php

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.