Email MFA is not a laptop column

Lesson map

Lesson 16. Map, example, EX062.

flowchart TD
  L["Laptop sign-in"] --> A["Standard or administrator token"]
  E["Cloud email"] --> M["Password plus authenticator"]
  M --> C["Backup codes in the safe"]
  A --> X{"Is MFA a sixth cell in the matrix?"}
  C --> X
  X -->|No| K["The script has five cells"]

A second factor on a cloud account is a different authenticator from the laptop token.

Logical drawing

matrix columns
    five, and none of them is MFA
email
    fourteen accounts
    authenticator on volunteers' phones
    backup codes in the office safe
    two people helped in person
phones
    not laptop rows, and not counted

Learning outcomes

After this chapter, you should be able to:

1. Keep cloud-email MFA off the quick-check dictionary.
2. Say which threat the second factor is aimed at in this case.
3. Refuse a printed code, a phone inventory, or a sign-in log the file does not contain.

16.1 The second factor binds a cloud authenticator. The matrix never asks that question.

The quick check has five cells. None is labelled MFA. Disk encryption can be perfect on a stolen laptop and still do nothing about the cloud email service, because that service is not the disk. Chapter 2 states the threat directly: a stolen password could open the email from anywhere. Multi-factor authentication is the control aimed at that path. Every email account gets an authenticator application on the volunteer's phone, and backup codes are kept in the office safe. The worked example counts fourteen accounts. Two volunteers need in-person help on their next shift. No backup code is printed. No phone number is printed. No count of failed prompts is printed. The phones that hold the authenticator are not FB keys, and the book does not count them. A lost phone is why the codes exist. The codes are not a census of handsets.

The monthly routine asks Leah, or the second trained volunteer, to look at the cloud service's sign-in alerts. NIST SP 800-92 is a guide to log management: what to generate, how to retain it, and how to review it. "Look at the alerts" is a habit in a fifteen-minute list. The file contains no alert text, no source address, and no timestamp. A look is not an export, and it is not evidence that an 800-92 logging standard was adopted. SP 800-53's IA-2 names identification and authentication for organisational users. The food bank's MFA statement is the prose above. It is not an IA-2 assessment package.

A locked-out person is a third path, and it is not the authenticator. Chapter 4 says Leah verifies the person by phone before resetting. The book does not print the questions she asks and does not print the number she calls. Phone verification is a check that the requester is the person. It is not the backup-code ceremony, and it is not a second run of the account matrix. The shared front-desk password in the vault remains a shared secret. Personal accounts inside the booking system are what make a booking traceable. Those two credentials must not be collapsed into one "MFA on the desk."

16.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. Two volunteers were helped in person. Their names are not in the file.

Errors and limits

Encryption of a laptop disk and authentication to a cloud mailbox fail in different places. A pass on one is not a pass on the other.

Apply

• EX062 — Which authenticator? A note adds an MFA column of 14 of 14 to the script, prints a backup code, and pastes a sign-in alert. What do you remove?
  Show marking criteria

  Rubric: 3 = remove all three; the script stays five columns; fourteen accounts, the safe, and the in-person help stay prose; no code, phone number, alert text, address, or timestamp is added; phone verification stays distinct from the backup codes;; 2 = MFA stays off the print;; 1 = one addition removed;; 0 = none.