The MFA Rollout That Locked Out the Night Shift

Don't pause MFA wholesale - that reopens the exact account-takeover risk the fatigue attack is exploiting. Pausing removes the control precisely when it's under attack.

Reframe the problem: the rollout failed on enrollment and usability, not on the security value of MFA. The evidence:

• 600 lockouts = a population/device mismatch (no personal smartphones, shared devices).
• Credential sharing = users routing around a control that blocks their work - a predictable human response, not malice.
• Push fatigue = the method is weak against a motivated attacker.

Recommendation:

1. Keep MFA mandatory but fix enrollment: issue hardware tokens or desk phones for staff without smartphones; support shared-device workflows properly.
2. Harden the push method: number-matching, or move high-risk users to phishing-resistant factors (FIDO2).
3. Stop the sharing immediately - revoke shared supervisor sessions, and pair the fix with a short, explicit amnesty so staff report workarounds without discipline.

Judgement: the correct move is to fix the control's fit to the population, not to remove the control. Pausing is the easy answer the sponsor wants; it's the wrong one.

Credential sharing:

• Treat as a symptom first: the policy made work impossible for a group. Disciplining 600 people is not a security strategy.
• Immediate: force password resets on shared supervisor accounts, review their session/access logs for misuse, and close the workaround by providing a legitimate path (shared-device enrollment, kiosk accounts with proper attribution).
• Policy: clarify that sharing is prohibited, but pair enforcement with the amnesty so the first report isn't punished.

MFA fatigue cluster:

• Correlate the uninitiated pushes to specific accounts - this indicates valid passwords already compromised (the attacker is at the password step).
• Force resets on those accounts, review sign-in logs for successful approvals, and check for any that were approved.
• Switch those users to number-matching/FIDO2 and rate-limit or block push spam.

Key insight: the fatigue prompts prove the password layer is already defeated for some accounts. The push attack is the second stage; the pause would expose the first stage with nothing behind it.

The rollout treated MFA as a checkbox, not as a control that must fit its population. Failures:

• No population analysis: 4,000 staff, many without smartphones/shared devices - the factor choice ignored the actual user base.
• No pilot on the hardest cohort: night shift was the stress case and was discovered in production.
• Method chosen for convenience, not threat model: push is easy to deploy and weak against fatigue; phishing-resistant factors weren't considered for high-value accounts.
• No workaround plan: when the control blocked work, users invented one (sharing), and the org's first instinct was discipline.

Changes:

• Segment the population by capability and risk; match factor to cohort (hardware tokens for shared-device/no-smartphone staff; FIDO2 for privileged/high-risk).
• Pilot on the most constrained group first.
• Build the legitimate path before enforcing, so the only way to work is the compliant way.
• Define success metrics (lockout rate, ticket volume) and a rollback of the method, not of the requirement.

Exam-tested principle: a control that users must bypass to do their job is a design failure, and the fix is design, not punishment.