A vendor technician remotely connects over VPN to perform scheduled substation maintenance. The utility requires the vendor to supply both a password and a push-approved code from a mobile authenticator app before the session is established. What security property does this combination primarily provide compared to password-only VPN access?
Select an answer to reveal the explanation.
Short Explanation
A password that leaks somewhere else — reused, phished, guessed — used to be enough on its own to get a vendor session started. Adding a push-approved code means an attacker also needs that vendor's phone, not just a password they scraped off a breach list. It's the same VPN, same tunnel, just a much harder front door to force.
Full Explanation
Requiring a password plus a mobile-app push-approved code establishes the VPN session only after two independent factors are satisfied, so a leaked, guessed, or phished password by itself is no longer sufficient for an attacker to impersonate the vendor — this is the core security benefit of two-factor authentication applied to remote access. It says nothing about the vendor laptop's malware state; endpoint health is a separate concern addressed by different controls, such as posture checks, not by authentication factors. Group membership still governs what the vendor account can access once authenticated — two-factor changes how strongly identity is verified, not whether group-based policy matching is still required, so the vendor account still needs correct group assignment. The tunnel's encryption cipher is negotiated independently as part of the VPN protocol configuration and is unaffected by how many authentication factors were required to establish the session. A practical caveat: push-based approval can be undermined by 'approval fatigue' attacks where a user reflexively approves a prompt they did not initiate, so pairing it with user awareness training matters. To confirm the control is working, attempt a login with only the password and verify the session is not established until the push is approved.