IA-B-01Level 1 · Signal
Removes an MFA factor
A risky behavior signal from the identity provider: the person deactivated a multi-factor authentication method on their own account.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.AA-03
- MITRE ATT&CK
-
- T1556.006
The definition, in detail
Definition
Downgrading factors weakens the account, and attackers do the same after a takeover.
Example
A regional manager removes his authenticator app after getting a new phone and falls back to SMS codes for two weeks.
How it is measured
- Source
- Identity provider & MFA
- Subject
- Person
- Event
- mfa.factor.deactivated
- Risk domain
- Identity and access
- Provenance
- Framework research
How it is used
Programs count "Removes an MFA factor" per person from Identity provider & MFA and read it beside the other Identity and access signals; it feeds 1 cohort, 0 sequences and 1 breach scenario.
A "removes an MFA factor" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0024Sends credentials through chat messages
- I.0047Accepts voice call MFA code requests over SMS
- I.0048Shares OTP or MFA codes via email or chat messages
- I.0049Approves suspicious or fraudulent MFA requests
- I.0105Logs into enterprise services using personal accounts
- I.0106Shows simultaneous logins from geographically distant IPs
- I.0107Continues using expired credentials for cloud access
- I.0108Avoids enterprise single sign-on
- I.0111Stores unencrypted credentials in shared cloud folders
- I.0127Uses root credentials for cloud administrative access
- I.0138Misuses elevated privileges to access sensitive resources
- I.0139Abuses access privileges in ways that do not comply with policy
- I.0140Steals or harvests credentials using unauthorized tools
- I.0141Accesses protected resources from unusual locations
- I.0147Relies on insecure or temporary credentials to maintain access
- I.0149Engages in activity inconsistent with approved roles
- I.0151Accesses secrets or vaults in unauthorized or unusual ways
- I.0153Uses weak or bypassed authentication methods to gain access
- I.0154Accesses protected resources at unusual volumes or frequency
- I.0170Signs into corporate apps from unapproved devices or locations
- I.0172Bypasses SSO to access SaaS platforms directly
- I.0295Logs in during unusual remote work hours
- I.0296Generates repeated remote login failures
- I.0297Shares corporate credentials with household members
- I.0306Reuses home network credentials on corporate systems
- I.0312Uses shared household accounts on corporate devices
- I.0314Uses outdated or insecure VPN protocols
- I.0319Connects from unsecured or unknown Wi-Fi networks
- I.0362Ignores breach-intel notifications beyond SLA
Continue exploring
"Removes an MFA factor" (IA-B-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ia-b-01-removes-an-mfa-factor
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.