Okay, got it. Record to the cloud, record to this computer. Cloud, I guess.
Okay.
Hello, everyone. We are presenting our Video Project 1 on multi-factor authentication.
In this session, we'll explain what MFA is. why it is important, how it is implemented.
How it is used in both business and personal computing, and how it will… how it can be bypassed or defeated.
So, what is MFA? MFA simply means verifying a user's identity with more than one independent factor.
Instead of relying only on password, MFA combines two or more probes.
Something you know, something you have, and something you are. For example, entering a password and approving a code.
on your phone. The goal is to make it.
far harder for someone. Else to impersonate you.
Why MFA matters. Most data breaches start with stolen or reused password.
MFS stops many of those attacks, because even if a password is leaked.
An attacker still needs that second factor. It's also a compliance requirement in most regulated industries, like healthcare, banking, and education.
Essentially, MFS rings the attack, surface, and limits the blast radius of credential tab.
The three classic categories are something you know. like a password or a PIN.
Something you have, such as a smartphone or a hardware key, and something you are, like a fingerprint or facial recognition.
Some modern systems. add a fourth layer called context, such as device health, location, or time of access.
to adaptively raise or lower challenge levels. Now my colleague will explain you.
about later slides.
There are different ways to implement WFA.
centralized single sign-on on systems, apply one MFA policy across multiple applications.
Step Up MFA triggers an extra factor only for sensitive actions.
Risk-based or adaptive MFA uses analytics to decide when a challenge is needed.
And finally, passwordless authentication.
like, 502, or Web Authentication, binds the credential to the device itself, removing passwords entirely.
In business, MFA protects access to email, VPNs, internal systems, reducing insider risk, ensuring compliance.
Personally, it protects your social media, banking, uh, online banking, and clouded accounts from hijacking.
Both contexts share one mission, eliminating password-only authentication as a single point of failure.
MFA is powerful.
but not invincible. Attackers use phishing proxies to intercept one-time codes or tokens.
They cause push fatigue by sending multiple approvals prompt until users click yes out of annoyance.
SIM swapping lets them steal SMS codes by hijacking a phone number.
And weak recovery processes, like easy help desk resets, can bypass MFA entirely if not secured.
And here's a real MFA bypass.
how a real MFA bypass might happen.
A user enters their login on a phishing site that securely forwards it to the real service.
The victim then approves the legitimate MFA request.
Not realizing it came from the attacker.
The attacker captures that authenticated session token and gains full access.
The lesson is that origin binding and short token lifetimes are essential.
Um, to defend against these attacks, organizations should use phishing-resistant MFA, like hardware keys or platform biometrics.
Tokens should expire quickly, and re-authentication should be required for sensitive tasks.
Recovery processes must be strictly verified and locked.
And perhaps most important, users need training to recognize fraudulent prompts or suspicious login
activity.
These are our references, and thank you.