Häufig gestellte Fragen
Is a one-time code sent by SMS (SMS OTP) sufficient as MFA?
Formally, an SMS code fulfils the principle of multi-factor authentication because it covers the possession factor (the mobile phone), but it is considered the weakest widespread variant. SMS messages travel over mobile networks that were never designed as a secure authentication channel and can be intercepted via SIM swapping or vulnerabilities in the SS7 protocol. The US standards institute NIST has advised against SMS since as early as 2016 and now classifies it as a restricted authenticator in its SP 800-63 guideline. For low-privilege accounts, SMS OTP is therefore better than no second factor at all, but for administrative or finance access in the ERP, app-based one-time codes (TOTP) or FIDO2 keys should be used.
What are passkeys and how do they differ from classic MFA?
Passkeys are passwordless credentials based on the FIDO2 and WebAuthn standards, in which a cryptographic key pair is bound to the user's device and approval is given via biometrics, PIN or device unlock. Unlike TOTP or SMS codes, passkeys rely on asymmetric cryptography instead of shared secrets and are therefore inherently phishing-resistant, because the credentials are bound to the respective domain and simply do not work on a fake website. They are regarded as the next evolutionary stage after classic MFA and are now supported by all major operating systems and browsers. In the ERP context, they are particularly suitable for especially sensitive roles, provided the system or the connected identity service supports WebAuthn.
Is MFA legally required for companies?
There is no blanket MFA obligation for all companies, but for certain organisations it effectively follows from regulatory requirements. The NIS 2 Directive and the German NIS 2 implementation act explicitly name multi-factor or continuous authentication as one of the required risk management measures for so-called important and particularly important entities. Depending on classification, violations can incur fines in the millions (up to ten million euros for particularly important entities), and management can be held personally liable. In addition, there are industry-specific requirements and audit standards such as SOC 2, which do not explicitly mandate MFA for critical systems but effectively presuppose it as an audit-relevant expectation of strong access controls.
What is the difference between MFA and 2FA?
Two-factor authentication (2FA) is a special case of multi-factor authentication with exactly two mutually independent proofs, while MFA is the umbrella term covering two or more factors. Both methods rest on the same three categories of knowledge, possession and inherence, and in both cases it is crucial that the factors come from different categories. Two passwords in succession therefore count as neither 2FA nor MFA, because both belong to the knowledge factor. In practice, most logins work with two factors, so the terms 2FA and MFA are often used interchangeably in everyday language.
What is an MFA fatigue attack and how can it be prevented?
In an MFA fatigue attack, also known as push or prompt bombing, the attacker already holds a valid password and triggers numerous push requests in quick succession, hoping that the annoyed or inattentive user will approve one of them. The method works because simply tapping away a push notification requires hardly any cognitive effort, and habit and stress increase the likelihood of error. Effective countermeasures include number matching, where the user must type a number shown at login into the app, as well as additional context on location and application, limits on request frequency, and training. The strongest protection comes from phishing-resistant methods such as FIDO2 or passkeys, since these no longer involve approval by a simple tap.
How do you sensibly introduce MFA in an existing ERP system?
A staged rollout is recommended, starting with administrative access and particularly critical roles such as accounting, and then extending to the entire workforce. Many ERP solutions include MFA natively or can be connected via a central identity service such as Active Directory or a cloud directory service, which is preferable to an isolated standalone solution. Clearly defined processes for device loss and recovery as well as stored backup codes are important, so that locked-out users do not block operations. Since cumbersome procedures invite workarounds, employee acceptance and training are just as important as the technical implementation itself.