ANALYSIS OF THE EFFECTIVENESS OF TWO-FACTOR AUTHENTICATION AND THE HUMAN FACTOR IN CYBERSECURITY

Abstract

In the digital environment, where information has become one of the most valuable resources, ensuring its confidentiality and integrity is a top priority for both government institutions and the private sector. Given the growing diversity of cyber threats and the rapid increase in incidents of unauthorized access to user accounts, traditional password-based authentication methods are no longer sufficient to provide an adequate level of protection. The widespread use of social engineering techniques, phishing attacks, malicious software, and automated password-cracking technologies has emphasized the urgent need for more secure and resilient authentication mechanisms. One such method is two-factor authentication (2FA), which relies on the combination of at least two independent factors for identity verification. Although 2FA is supported by most modern digital services and platforms, its effectiveness in practice is determined not only by its technical implementation but also by the behavior of the end user. This paper presents a comprehensive approach to analyzing the resilience of two-factor authentication systems, addressing both technological solutions and the human factor as a potential vulnerability. A series of practical experiments were conducted to simulate typical threat scenarios, including code delivery failures, device loss, and manipulation of time parameters. The results reveal that unauthorized access often becomes possible due to poor storage of backup codes, users’ limited awareness of authentication principles, and the use of insecure delivery channels such as SMS. Particular attention is drawn to the issue of users refusing to configure additional recovery mechanisms, which may lead to permanent account loss. The study evaluates the effectiveness of tools such as Google Authenticator, Authy, hardware tokens, and cryptographic protocols like FIDO2. The findings justify the need to integrate multi-level authentication systems with clear user guidance, time synchronization checks, and automated suspicious activity monitoring. It is concluded that an optimal combination of technical safeguards and user digital literacy forms the foundation for building robust authentication mechanisms capable of countering contemporary cybersecurity threats.