## Chapter 16 — Email MFA is not a laptop column ### Lesson map Lesson 16. Map, example, EX062. ```mermaid flowchart TD L["Laptop sign-in"] --> A["Standard or administrator token"] E["Cloud email"] --> M["Password plus authenticator"] M --> C["Backup codes in the safe"] A --> X{"Is MFA a sixth cell in the matrix?"} C --> X X -->|No| K["The script has five cells"] ``` A second factor on a cloud account is a different authenticator from the laptop token. ### Logical drawing ```text matrix columns five, and none of them is MFA email fourteen accounts authenticator on volunteers' phones backup codes in the office safe two people helped in person phones not laptop rows, and not counted ``` ### Learning outcomes After this chapter, you should be able to: 1. Keep cloud-email MFA off the quick-check dictionary. 2. Say which threat the second factor is aimed at in this case. 3. Refuse a printed code, a phone inventory, or a sign-in log the file does not contain. ### 16.1 The second factor binds a cloud authenticator. The matrix never asks that question. The quick check has five cells. None is labelled MFA. Disk encryption can be perfect on a stolen laptop and still do nothing about the cloud email service, because that service is not the disk. Chapter 2 states the threat directly: a stolen password could open the email from anywhere. Multi-factor authentication is the control aimed at that path. Every email account gets an authenticator application on the volunteer's phone, and backup codes are kept in the office safe. The worked example counts fourteen accounts. Two volunteers need in-person help on their next shift. No backup code is printed. No phone number is printed. No count of failed prompts is printed. The phones that hold the authenticator are not `FB` keys, and the book does not count them. A lost phone is why the codes exist. The codes are not a census of handsets. The monthly routine asks Leah, or the second trained volunteer, to look at the cloud service's sign-in alerts. NIST SP 800-92 is a guide to log management: what to generate, how to retain it, and how to review it. "Look at the alerts" is a habit in a fifteen-minute list. The file contains no alert text, no source address, and no timestamp. A look is not an export, and it is not evidence that an 800-92 logging standard was adopted. SP 800-53's IA-2 names identification and authentication for organisational users. The food bank's MFA statement is the prose above. It is not an IA-2 assessment package. A locked-out person is a third path, and it is not the authenticator. Chapter 4 says Leah verifies the person by phone before resetting. The book does not print the questions she asks and does not print the number she calls. Phone verification is a check that the requester is the person. It is not the backup-code ceremony, and it is not a second run of the account matrix. The shared front-desk password in the vault remains a shared secret. Personal accounts inside the booking system are what make a booking traceable. Those two credentials must not be collapsed into one "MFA on the desk." ### 16.2 Worked example | Object | Where it lives | In the five-cell print? | |---|---|---| | Authenticator application | Volunteers' phones | No | | Backup codes | Office safe | No | | Sign-in alert review | Monthly habit | No log line stored | | Laptop standard-user bit | The dictionary | Yes, and it is not MFA | > **Synthetic case.** Two volunteers were helped in person. Their names are not in the file. ### Errors and limits Encryption of a laptop disk and authentication to a cloud mailbox fail in different places. A pass on one is not a pass on the other. ### Apply - **EX062 — Which authenticator?** A note adds an MFA column of 14 of 14 to the script, prints a backup code, and pastes a sign-in alert. What do you remove? *Rubric:* 3 = remove all three; the script stays five columns; fourteen accounts, the safe, and the in-person help stay prose; no code, phone number, alert text, address, or timestamp is added; phone verification stays distinct from the backup codes;; 2 = MFA stays off the print;; 1 = one addition removed;; 0 = none. ### Continue studying — lesson 16 (chapter 16 of 20) [← Chapter 15](#ch-15) · [Course chapter index](../SUBJECTS.md) · [Chapter 17 →](#ch-17) Continue to the next authored lesson. ## Worked answers **EX062.** Remove the extra column, the code and the pasted alert. The script stays five columns. Fourteen accounts, the safe and the in-person help stay prose. Phone verification stays distinct from the backup codes.