Authenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authenticator (FIDO2, smartcards). Higher AAL is mandatory for higher-impact systems.
Assurance levels matter because they let a policy say "this action requires AAL2" instead of naming a specific product, which survives vendor changes. The practical jump is AAL2 to AAL3: push notifications and one-time codes satisfy AAL2 but are relayed by attacker-in-the-middle kits every day, while AAL3 requires a cryptographic authenticator bound to the origin. US federal systems and a growing set of regulated industries map controls directly to these levels.
See also: NIST 800-63, phishing-resistant MFA, WebAuthn and FIDO2, IAL
Related on Start with Identity
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryHOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant met
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- GlossaryPassword Spraying
Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA. Spraying is designed to
- CVEZimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March
- CVECyberArk Conjur IAM authenticator bypass via malformed regex
Conjur's AWS IAM authenticator could be pointed at an attacker-controlled STS by a malformed regex (CWE-807). CVSS 9.1. One of five Cyata findings, chainable to