← Home
Multi-Factor Authentication (MFA)
Multi-factor authentication (MFA) requires two or more independent factors
to verify a person, device or system before granting access. In Industrial Automation and
Control Systems (IACS), MFA is especially important for remote access, privileged interactive
logins and other high-consequence paths into the Automation Solution.
Teaching note: Paraphrased for learning from IACS cybersecurity course
material and ISA/IEC 62443 practice. Not a substitute for the normative text of
ISA/IEC 62443 or site identity policy.
Related:
IEC 62443-3-1 Clause 5 Authentication
|
USER 1.9 – Multifactor authentication
|
FR 1 / SR 1.1
|
Secure Remote Access
|
IEC 62443-3-1 Clause 7.3 VPN
|
Jump Host
|
Active Directory
|
Digital Certificates
Authentication factors
Employ two or more of the following when determining authenticity:
- Something you know — PIN, password or passphrase
- Something you have — certificate, hardware token, smart card or dongle
- Something you are — biometric such as fingerprint or retinal signature
- Where you are — location or network context (for example GPS or trusted zone)
Factors must be independent: compromising one should not automatically compromise another.
Why MFA matters in OT
- Passwords alone are routinely phished, shared on shared HMIs, or reused across systems.
- Remote vendor and maintenance access is a common attack path; MFA raises the cost of
stolen credentials.
- Privileged engineering and administrator accounts can change logic, accounts and
network devices — MFA reduces the chance that a single secret grants that power.
ISA/IEC 62443 expectations
- Part 2-1 USER 1.9
— multifactor authentication as part of the asset owner’s user access control programme.
- Part 3-3 FR 1
— requirement enhancements raise MFA expectations as Target Security Level increases.
Map MFA requirements into the Cybersecurity Requirements Specification (CRS) and verify them
during
CFAT / CSAT.
OT design tips
- Require MFA for remote access sessions and for privileged interactive logons where
practical.
- Provide separate authentication mechanisms for internal and external users where policy
requires it.
- Prefer factors that work offline or with limited connectivity when control rooms cannot
depend on cloud authenticators.
- Combine MFA with a
jump host / DMZ pattern so remote sessions terminate in a
controlled zone before reaching control networks.
- Log MFA success and failure events into the site monitoring / SIEM path so failed
attempts support detection and incident response.
Key takeaways
- MFA uses two or more independent factors (know / have / are / where).
- Prioritise MFA for remote and privileged IACS access.
- Align implementation with Part 2-1 USER 1.9 and Part 3-3 FR 1 SL-dependent enhancements.