New MFA mandates for FIs

Regulations like FTC guidelines and 23 NYCRR 500 have raised a high bar on MFA

Financial institutions – whether systematically important banks (SIFIs), local and regional banks, savings and loan institutions, payment networks or insurance companies – have long been on the front lines of digital technology. They’re of course security-conscious and highly regulated already, but that doesn't keep cybercriminals and other adversaries from making them their preferred target.

The cybersecurity industry has seen time and again how a specific defense method is implemented only to have criminals find a way to thwart it at scale. What follows is a rapid exploitation of existing protections and desperate scrambles for replacements. Only then do standard and audit bodies close off these gaps with updated tech and start auditing against revised requirements.

That’s precisely where we’re at with MFA today.

Problems with MFA

Multifactor authentication (MFA) has experienced a continual back-and-forth between “defender deployment” and “adversary compromise” since it was introduced in 2019. As widespread adoption began, two truths emerged:

• MFA is only as strong as you make it: there are many different factors to choose from in modern MFA architecture. While some are easy to deploy but may also be inherently weak (like all knowledge factors and one-time passwords) others are traditionally more difficult to manage, even though they’re more robust (like possession factors and some types of biometrics).
• Adversaries will ruthlessly root out the weaker forms of MFA: Once an exploit has achieved success against any form of MFA – but especially weaker code-based or knowledge-based forms – they whither under an onslaught of ATO attempts.

Organizations who deploy MFA need to keep this in mind, from initial design to later refinement. Luckily, there’s excellent guidance available on “what makes good MFA.”

“Strong MFA” according to CISA & NIST

No organization is perhaps more knowledgeable about what works and what’s prone to fail in cyber defense strategies than the U.S. Cybersecurity and Infrastructure Security Agency, or CISA. When it comes to MFA, CISA has gone to great pains to define and document the only options that are suitable to achieve phishing resistance: a) PKI-based solution like those that create and deliver TLS certificates; or b) FIDO2-based solutions that leverage WebAuthn, another form of PKI.

‍

To achieve MFA that’s robust and morespecifically phishing-resistant, no other form of authentication is advised.

Not only does CISA make thisrecommendation, but so does NIST, the National Institute of Standards andTechnology. In their 2024 update to SP 800-63, which covers digital identitiesand lifecycles, they highlight the need for phishing resistance and clearlystate:

“Anauthenticator is phishing-resistant if it is a cryptographic authenticator thatbinds its output to a communication channel (e.g., client-authenticated TLS) ora verifier name (e.g., FIDO2/WebAuthN).”

Despite the heavy “officialese” in thisstatement, it’s saying effectively the same thing that CISA said: TLS-based orFIDO-2-based PKI is the way to go.

MFA in financial regulations

While requirements for multifactorauthentication were introduced into most financial-services orientedregulations around 2018, a series of damaging exploits made it clear there wasmuch more to do in order to keep customers and financial data safe:

• First American Financial, 2019:885 million records linked to real estate transactions exposed through websitedesign error
• Capitol One, 2019: 100 millioncredit card applications intentionally exposed by an AWS engineer
• JP Morgan Chase, 2014: 83million accounts exposed, not fully discovered until 2019
•  Equifax, 2017: 147 million UScustomers impacted by exploited records
• Experian, 2020: 24 millionfinancial customers compromised through phishing campaigns

Not all of these attacks were due to poorlymanaged or incompletely deployed MFA. To get more insight into the differencesbetween “good” MFA and “bad” MFA, watch this short video on current MFAexploits. But the scope of these attacks (and many more like them) made itabundantly clear that financial institutions were still high on two lists:

• The targets that criminal andnation-state adversaries most wanted to compromise, and
• Organizations whose systemswere most in need of continual upgrades.

While regulatory standards are slow toevolve (much slower than adversarial tactics) there has been a sea change inthe last 24 months. Now a whole host of financial-oriented regulations andstandards are not just requiring “MFA,” but are also declaring the need for“phishing resistant MFA” in the way CISA defines it.

Phishing resistance needs to happen fast

The regulations and standards above areasking for these changes fast: the FTC Safeguards guidance, for instance,requires immediate action. This regulation covers any organization thatparticipates in commerce with financial institutions, has a broad span ofcontrol. Mortgage lenders, payday lenders, mortgage brokers, account servicers,check cashers, wire transferors, collection agencies, credit counselors andother financial advisors, tax preparation firms, non-federally insured creditunions, and many types of investment advisors must subject themselves to FTCSafeguards audits ... which now include the use of phishing-resistant MFA inalmost all use cases for account access.

The FTC introduced these updated rules infall of 2023, and they took effect in summer 2024. For other standards bodiesand compliance regimes, similar changes are happening at a similar pace.

How Axiad can help

A common refrain from financial servicesorganizations is “But I already have an authentication system in place for MFA!Do I need to rip-and-replace this expensive system to achieve phishingresistance and meet these new requirements?”

Fortunately, the answer is “No.”

Most of these requirements assume thatorganizations already have, or are planning to install, a credential managementsystem (CMS) to automate the delivery of FIDO2-based or TLS-based digitalcredentials into their authentication processes. The CMS doesn’t take overauthentication: it simply manages the lifecycles of the increasingly criticalcredentials that make phishing-resistant MFA possible. The CMS injects theright credentials into the authentication process at the right time, whereverworkflows or security requirements demand their presence.

Axiad Conductor lets identity teams managemultiple strong credentials—from FIDO to TLS certificates—across differentoperating systems, platforms and devices. This delivers audit-ready phishingresistance that doesn’t require new investments in MFA.

Best of all, the CMS that enables phishingresistance can be added to almost any existing MFA solution. Axiad Conductordoesn’t need to be your authentication platform to add value. When paired withhardware-based authenticators, like those from Yubico, Idemia, Thales orFeitian, Conductor makes your systems phishing resistant on Day 1.

For more information on Axiad Conductor,the award-winning CMS that helps Financial Institutions become more secure andmore nimble, visit our site at www.axiad.com for more details. You can downloada product brief or calculate your savings over manually managed andadmin-deployed MFA solutions.

And if on the off chance you look at thetable above and say, “My most critical audit isn’t asking for phishingresistance yet,” count yourself lucky. But be prepared for imminent changes,too.

‍