Database administrators connect remotely to production database servers using only a username and password. After a phishing campaign targeted IT staff, the security team wants to make stolen passwords insufficient for privileged access. Which control should be required?
Select an answer to reveal the explanation.
Short Explanation
If a phisher already has your password, a longer password doesn't help you one bit. MFA adds a second thing the attacker doesn't have, like a token or authenticator prompt, so the stolen password alone gets them nowhere. Don't be fooled by lockout; a correct stolen password never fails in the first place.
Full Explanation
Multifactor authentication requires two or more independent factor types: something the user knows, such as a password; something the user has, such as a hardware token or authenticator app; and something the user is, such as a biometric. When a password is stolen through phishing, the attacker still lacks the second factor, so privileged access is denied. Requiring MFA for remote and privileged database access is a standard control because those accounts carry the greatest impact if compromised. A longer minimum password length increases resistance to guessing and cracking but provides no protection when the user hands over the password itself. More frequent password changes may shorten the useful life of a stolen password, but an attacker usually uses it quickly, and forced changes often lead to weaker, predictable passwords. Account lockout counters repeated guessing; a phished password succeeds on the first try and never triggers it. Exam caveat: phishing-resistant factors such as hardware security keys are stronger than codes sent by text message, which can be intercepted or socially engineered. Operational check: attempt a remote privileged login with valid credentials but without the second factor and confirm it is denied, then review authentication logs to confirm every privileged session records MFA.