IA-B-07Level 1 · Signal
Uses SMS as the only MFA factor
A risky behavior signal from the identity provider's factor inventory: the person's only registered second factor is a text message code.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.AA-03
- MITRE ATT&CK
-
- T1111
The definition, in detail
Definition
SMS codes can be intercepted by SIM swapping or relayed through a phishing page.
Example
A regional director has only a phone number registered for MFA, and a SIM swap would let an attacker receive her codes.
How it is measured
- Source
- Identity provider & MFA
- Subject
- Person
- Event
- Factor inventory
- Risk domain
- Identity and access
- Provenance
- Gartner
How it is used
Programs count "Uses SMS as the only MFA factor" per person from Identity provider & MFA and read it beside the other Identity and access signals; it feeds 0 cohorts, 0 sequences and 1 breach scenario.
A "uses SMS as the only MFA factor" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0024Sends credentials through chat messages
- I.0047Accepts voice call MFA code requests over SMS
- I.0048Shares OTP or MFA codes via email or chat messages
- I.0049Approves suspicious or fraudulent MFA requests
- I.0105Logs into enterprise services using personal accounts
- I.0106Shows simultaneous logins from geographically distant IPs
- I.0107Continues using expired credentials for cloud access
- I.0108Avoids enterprise single sign-on
- I.0111Stores unencrypted credentials in shared cloud folders
- I.0127Uses root credentials for cloud administrative access
- I.0138Misuses elevated privileges to access sensitive resources
- I.0139Abuses access privileges in ways that do not comply with policy
- I.0140Steals or harvests credentials using unauthorized tools
- I.0141Accesses protected resources from unusual locations
- I.0147Relies on insecure or temporary credentials to maintain access
- I.0149Engages in activity inconsistent with approved roles
- I.0151Accesses secrets or vaults in unauthorized or unusual ways
- I.0153Uses weak or bypassed authentication methods to gain access
- I.0154Accesses protected resources at unusual volumes or frequency
- I.0170Signs into corporate apps from unapproved devices or locations
- I.0172Bypasses SSO to access SaaS platforms directly
- I.0295Logs in during unusual remote work hours
- I.0296Generates repeated remote login failures
- I.0297Shares corporate credentials with household members
- I.0306Reuses home network credentials on corporate systems
- I.0312Uses shared household accounts on corporate devices
- I.0314Uses outdated or insecure VPN protocols
- I.0319Connects from unsecured or unknown Wi-Fi networks
- I.0362Ignores breach-intel notifications beyond SLA
Continue exploring
"Uses SMS as the only MFA factor" (IA-B-07), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ia-b-07-uses-sms-as-the-only-mfa-factor
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.