Skip to main content
Review and revision metadata
Review Date: 2026-06-16
Reviewer: Operations Manager

previous version on gdrive

Awareness: Enhanced MFA Security (Number Matching & Context)

This document details the Multi-Factor Authentication (MFA) enhancements deployed within the myDRE ecosystem. These updates are engineered to neutralize MFA Fatigue Attacks and fulfill our security obligations under ISO 27001 (A.5.15, A.8.5) and NIS 2 (Access Control & Identity Management).

info

Classification: Public

Primary Target: End-users, DPOs, and Compliance Auditors.

1. Threat Landscape: MFA Fatigue Attacks​

Multi-Factor Authentication relies on two distinct factors: something you know (username and password) and something you have (your authenticated device).

To circumvent this, malicious actors utilize a social engineering tactic known as an MFA Fatigue Attack:

  1. The attacker obtains or guesses a user's login credentials.
  2. The attacker triggers continuous, rapid MFA push notifications to the user's phone.
  3. The user, suffering from notification fatigue or assuming a system malfunction, accidentally or intentionally clicks "Approve" to stop the alerts, inadvertently granting the attacker access.

2. Advanced Defenses Enforced in myDRE​

To protect the platform against these human-error exploits, anDREa integrates Microsoft’s advanced security features within the Microsoft Authenticator app.

When approving an MFA prompt for myDRE, users see three distinct contextual guardrails:


┌────────────────────────────────────────────────────────┐
│               MFA VERIFICATION PROMPT                  │
├────────────────────────────────────────────────────────┤
│  👤 Account:   your-user@mydre.org                     │
│  📱 App:       Digital Research Environment            │
│                (weu-andrea) - portal                   │
│  📍 Location:  [User's Detected Location]              │
│                                                        │
│  🔢 Action Required:                                   │
│     Enter the number displayed on your sign-in screen  │
│     [  ]                                               │
└────────────────────────────────────────────────────────┘

Key Security Guardrails​

  • Additional Context: The prompt explicitly names the application requesting access: Digital Research Environment (weu-andrea) - portal. If you see an unexpected application name, deny the request immediately.
  • Geographical Location: The app displays the approximate geographical location from which the login attempt originated. If the location does not match your current physical presence, deny the request.
  • Number Matching: When logging in, the web portal displays a specific two-digit number. You must type this exact number into your Microsoft Authenticator app to approve the session. This completely neutralizes blind "one-tap" approvals and eliminates fatigue-based exploits.

3. End-User Verification Requirements​

When you receive a push notification, consciously verify that the incoming data exactly matches your current active session:

  • Target Account: Your official @mydre.org username.
  • Application Title: digital research environment (weu-andrea) - portal.
  • Location: Your actual location.
  • Numeric Proof: Enter the matching digits displayed on your browser screen.

Auditor Note: These defensive mechanisms ensure compliance with strict zero-trust identity verification frameworks and regulatory data protection guidelines.