A single compromised credential can become a gateway to multiple business applications and systems. The risk becomes even more complex as IT environments span cloud platforms, data centers, SaaS applications, and hybrid infrastructure.
Enterprise Multi-Factor Authentication (MFA) adds an additional layer of verification beyond passwords. However, MFA methods that still rely on codes or approval prompts may not be enough to address modern phishing threats. Organizations should therefore consider phishing-resistant authentication alongside access policies that can adapt to different levels of risk.
Why Traditional MFA May No Longer Be Enough Against Modern Phishing
MFA can reduce the risks of compromised passwords, but its effectiveness still depends on the authentication method. Some methods remain vulnerable to threats such as Adversary-in-the-Middle (AitM) attacks and MFA fatigue, making phishing-resistant authentication increasingly important.
The Risks of AitM and MFA Fatigue
Attackers are increasingly using techniques such as Adversary-in-the-Middle (AitM) attacks, where a phishing site acts as an intermediary between the user and the legitimate service. This can allow attackers to capture authentication of information or session data and use it to gain unauthorized access.
Another technique is MFA fatigue, where attackers repeatedly send push authentication requests in an attempt to overwhelm or trick users into approving one.
The issue is no longer simply whether an organization uses MFA, but how resistant its authentication method is to be phishing and user manipulation.
The Business Impact of Account Takeover
Account takeover can give attackers access to business applications, systems, and sensitive data through compromised user accounts. Once inside, the impact can extend beyond unauthorized access to include operational disruption, incident investigation, account recovery, and potential data exposure.
For this reason, enterprise MFA should be considered as part of a broader identity security strategy rather than simply another login step.
Why Are FIDO2 and Passkeys More Resistant to Phishing?
FIDO2 uses public-key cryptography to authenticate users. WebAuthn is a key component of the FIDO2 standard, while passkeys use the same underlying cryptographic approach to enable passwordless authentication.
Unlike one-time passwords (OTPs), which can potentially be captured and relayed through a phishing site, FIDO2 authenticators verify the origin of the service requesting authentication. This means a credential registered for a legitimate domain is not simply reusable on a different phishing domain.
This origin-bound approach is what makes FIDO2 and passkeys phishing-resistant and suitable for organizations looking to strengthen authentication against modern credential attacks.
Key Differences Between SMS OTP, Authenticator Apps, and Security Keys
MFA Method
| Phishing Resistence | Key Risk | User Experience |
SMS OTP
| Low | Phishing, SIM swapping
| Easy but requires entering a code
|
Authenticator App
| Depends on implementation | OTP interception, AitM of MFA fatigue for push-based methods
| Convenient especially with push |
FIDO2 Security Key
| High/ phishing-resistant | Designed to prevent credentials from being used on the wrong origin
| Fast, typically using a tap, PIN, or biometric |
The right MFA approach depends on the organization’s risk profile, application environment, and user requirements. Higher-risk environments may benefit from phishing-resistant authentication as part of a stronger identity security strategy.
From a regulatory perspective, organizations should also consider applicable security and data protection requirements. For example, OJK’s SEOJK 29/2022 on cyber resilience and security for commercial banks refers to the use of MFA when accessing sensitive data or the entire network where necessary. Meanwhile, Indonesia’s Personal Data Protection Law (UU PDP) requires data controllers to take measures to protect personal data from unauthorized access.
These requirements do not specifically mandate FIDO2, but they highlight the importance of appropriate access controls and data protection measures
An Integrated Approach with Okta, F5, and Hitachi Vantara for Enterprise Security
Enterprise security requires more than protecting the login process alone. A layered architecture can connect identity, application, and data, with each layer applying appropriate security controls.
In this approach, Okta verifies user identity and applies MFA, F5 BIG-IP APM manages application access and access policies, Hitachi Vantara helps protect and recover critical data during cyber incidents. Together, these technologies can support a broader security strategy that extends from user authentication to application access and data resilience.
Okta MFA for Phishing-Resistant Identity
Okta MFA supports FIDO2 and WebAuthn for phishing-resistant authentication. It can also apply adaptive authentication based on contextual signals such as device, location, IP reputation, and user behavior.
When additional verification is required, organizations can apply step-up authentication based on the level of risk or sensitivity of the resource being accessed.
This allows security teams to strengthen authentication without necessarily applying the same level of friction to every login.
F5 BIG-IP APM for Centralized Application Access
F5 BIG-IP Access Policy Manager (APM) provides centralized authentication, Single Sign-On (SSO), and policy-based access control across applications. With per-request policies and step-up authentication, organizations can require additional verification when users access sensitive applications, resources, or functions.
This approach can be particularly relevant for environments that combine legacy applications, hybrid infrastructure, and cloud-native services.
Hitachi Vantara for Data Protection and Cyber Resilience
Security does not stop once a user has been authenticated. Organizations also need to protect the data and systems that could be targeted after an account is compromised.
Hitachi Vantara supports data protection and cyber resilience through capabilities such as immutable snapshots and CyberSense ransomware detection. CyberSense helps identify indicators of data corruption and can help organizations determine which snapshots are suitable for recovery.
This adds another layer of protection by helping organizations maintain data resilience even when an attack bypasses identity and access controls.
Frequently Asked Questions About Enterprise MFA
Q: What is the difference between traditional MFA and phishing-resistant MFA?
A: Traditional MFA methods such as OTPs or push notifications can still be exposed to phishing, AitM attacks, or social engineering, depending on how they are implemented. FIDO2-based authentication uses cryptographic credentials that are bound to the legitimate origin, making them significantly more resistant to phishing.
Q: Does enterprise MFA make user access slower?
A: Not necessarily. Adaptive authentication can use contextual and risk signals to determine when additional verification is needed. This can reduce unnecessary authentication prompts for lower-risk access while applying stronger verification when risk increases.
Q; How do Okta, F5, and Hitachi Vantara work together?
A: The three technologies address different layers of security architecture. Okta focuses on identity and MFA, F5 BIG-IP APM manages application access and authentication policies, while Hitachi Vantara provides data protection and cyber resilience. Together, they support a layered approach across identity, application, and data.
<H2> Strengthen Your Enterprise Access Security with Central Data Technology </H2>
Enterprise MFA is not simply about adding another step to the login process. Organizations need to consider the authentication method, access policies, risk context, and how critical data is protected after access is granted.
Want to explore how Okta, F5 BIG-IP APM, and Hitachi Vantara can support your organization’s IT security strategy? Contact the Central Data Technology (CDT), as part of CTI Group, team to discuss your requirements for identity security, application access, and cyber resilience.
Author: Wilsa Azmalia Putri – Content Writer CTI Group
