Don't Feed the Attackers: Is Your MFA Protecting More Than Your Password?

Multi-factor authentication (MFA) is one of the most effective ways to protect accounts and systems against unauthorized access. By requiring verification beyond a password, MFA significantly reduces the likelihood that stolen or compromised credentials alone will result in a successful account takeover. For the food and agriculture sector, strong authentication helps protect the interconnected systems that keep operations running, from agricultural management platforms and food processing facilities to inventory systems, transportation networks, and remote equipment access.

According to Microsoft's 2025 Digital Defense Report, MFA reduces the risk of identity compromise by more than 99%. Yet attackers continue to exploit weaknesses in authentication processes through a medley of tactics – including phishing, MFA request bombing, session theft, and fraudulent account recovery requests.

These threats are particularly concerning in an industry where compromised access can create cascading consequences. The Food and Ag-ISAC tracked 265 ransomware incidents affecting the sector in 2025 alone, underscoring the need to strengthen cybersecurity defenses across the farm-to-table supply chain. While MFA cannot prevent every attack, it remains a critical protection against unauthorized access.

This Cybersecurity Awareness Month, Food and Ag-ISAC is encouraging organizations: Don't Feed the Attackers. By strengthening the fundamentals and examining access points that may still leave gaps, we can make the food and agriculture sector more secure.

The Fundamentals: Strengthening Account Security Across Farm-to-Table Operations

MFA requires two or more authentication factors, typically combining “something you know” (a password), “something you have” (a security key or trusted device), or “something you are” (biometrics).

For food and agriculture organizations, implementing MFA consistently is especially important given the range of employees, systems, seasonal workers, and third parties involved in daily operations. Establishing a strong baseline begins with a few practical measures:

• Enable MFA Across Critical Accounts: Require MFA for email, financial platforms, cloud applications, inventory and logistics systems, and remote access. Prioritize administrative accounts and systems that support essential business or operational functions.
  

• Use Stronger Authentication Methods: Favor phishing-resistant options, such as passkeys and FIDO2 security keys, wherever practical. Authenticator apps are generally preferable to SMS or email-based codes, although not all methods provide the same level of protection.
  

• Recognize Suspicious Authentication Requests: Repeated or unexpected MFA prompts may indicate someone is attempting to access an account using compromised credentials. Employees should know to deny and report requests they did not initiate.
  

• Secure Account Recovery: Protect backup codes, maintain authorized authentication devices, and establish reliable identity verification procedures for resetting or replacing authentication methods.
  

These practices provide an important foundation, but organizations must also consider how they manage authentication across remote connections, third-party relationships, and operational environments to ensure all entry gates are closed.

Beyond the Fundamentals: Protecting Access Across the Food Supply Chain

As food and agriculture operations become more interconnected, authentication security must extend beyond traditional business accounts. Remote maintenance, equipment monitoring, automated processes, and vendor-supported systems introduce additional access points that require careful oversight.

Four important topics deserve particular attention, especially for food and agriculture organizations.

Invest in Phishing-Resistant Authentication

Traditional MFA methods, including SMS codes, one-time passwords, and some push notifications, can be intercepted or manipulated through phishing and social engineering. Phishing-resistant methods, such as FIDO2 security keys and properly implemented passkeys, provide stronger protection by cryptographically binding authentication to legitimate services.

Organizations should prioritize these methods for privileged users, remote access, and accounts supporting critical operations. When industrial processing equipment, harvesting technology, or legacy operational technology (OT) systems cannot directly support MFA, secure remote access gateways and controlled administrative access can make those environments safer and more resistant to attack.

Recognize and Defend Against MFA Bypass Techniques

Attackers increasingly target authentication steps and sessions rather than attempting to defeat MFA directly. MFA fatigue attacks rely on repeated approval requests, while adversary-in-the-middle (AiTM) phishing and infostealer malware can steal authenticated session tokens.

For food and agriculture organizations, these techniques may threaten employee accounts, vendor connections, and remote management platforms used to support processing lines and distribution hubs. To stop these attacks, start by enabling number matching for push notifications so staff cannot approve a login without manually confirming the right number. Set smart login rules that automatically restrict access based on device compliance or location, and lock session tokens directly to trusted devices so stolen cookies cannot be imported onto an attacker's computer.

Close Gaps in Third-Party and Operational Access

Equipment manufacturers, maintenance contractors, logistics partners, and other third-party entities often need access to systems that support daily operations. Without appropriate oversight, these connections can become alternative entry points into your organization's environment. Attackers routinely seek out these paths of least resistance: targeting unmonitored automated accounts, legacy systems, or support desks that can be tricked into giving access.

Review where third parties have access across your facility or fleet, enforce MFA where supported, limit permissions to authorized activities, and remove access when it is no longer needed. Service accounts and automated API connections that cannot use interactive MFA require separate protections, including credential management and least-privilege access controls.

Monitor Authentication Activity and Strengthen Response

MFA alone does not provide a complete picture of authentication security. Security teams should also evaluate suspicious login attempts, repeated MFA denials, unexpected device registrations, and changes to authentication settings.

Creating clear procedures for investigating suspicious activity, revoking active sessions, and containing compromised identities is particularly important when access extends into plant operations or distribution control systems. Coordination between IT, OT, and facility management teams ensures that authentication-related incidents are addressed quickly without creating unnecessary disruptions to essential food production and delivery schedules.

Questions Food and Agriculture Defenders Should Be Asking

As your organization assesses its authentication security, consider the following questions:

1. Are we protecting our most critical accounts and systems? Is MFA enforced for privileged users, remote connections, and access points supporting essential processing and distribution operations?

2. Can attackers bypass our MFA protections? Are we accounting for phishing, MFA fatigue, session hijacking, and other evolving techniques across our workforce and vendor logins?

3. Where are our authentication gaps? Do third-party vendor connections, legacy plant hardware, account recovery processes, or automated identities create unnecessary exposure?

4. Can we detect and respond to authentication threats quickly? Are IT and OT teams prepared to investigate suspicious activity together and contain compromised access before it impacts operations?

Don't Feed the Attackers: Secure Every Link in the Chain 

No single defense should stand alone in cybersecurity. For the food and agriculture sector, strong authentication is about more than protecting individual accounts — it helps safeguard the connections between people, technology, and operations that support the production, processing, transportation, and distribution of food.

Reviewing where MFA is enforced, strengthening authentication methods, and evaluating the security of remote and third-party access is vital to protecting the food supply chain that communities rely on every day.

That brings us to our next Cybersecurity Awareness Month focus area - phishing. Modern attackers frequently use deceptive emails and fake portals to target employees and compromise credentials across the supply chain. We’ll dive deep into how to recognize, defend against, and report sophisticated phishing threats. Be sure to check back for our third blog post in the series!

Securing our food supply chain is a shared responsibility, and defenders shouldn’t have to stand alone against evolving identity threats. Cybercriminals actively collaborate, swapping tactics, tools, and compromised access – this makes collective defense across our industry essential. By reporting suspicious sign-in activity and sharing your experiences, your organization helps arm food producers, processors, and distributors nationwide with the insights needed to stop attacks before they disrupt operations.