Modelo para la evaluación de amenazas en sistemas de autenticación Multi-factor: Análisis y estrategias de mitigación en empresas del sector Financiero

Abstract

Technological evolution has radically transformed how organizations manage the security of their digital assets. In this environment of persistent threats, multi-factor authentication (MFA) has become one of the most widely used control mechanisms to mitigate risks associated with unauthorized access to information systems. By combining different authentication factors —something the user knows, possesses, or is— MFA seeks to overcome the weaknesses of traditional password-based systems. Its adoption has accelerated in critical sectors such as finance, where protecting data and electronic transactions is essential to ensure operational continuity and client trust. However, despite the benefits of MFA, its implementation is not exempt from vulnerabilities. Attackers have developed increasingly sophisticated techniques to bypass controls through targeted phishing, man-in-the-middle (MitM) attacks, social engineering, second-factor bypass, and abuse of push notification systems, such as MFA bombing. These weaknesses are particularly concerning in financial institutions, where authentication breaches can result in substantial financial losses, regulatory sanctions, and severe reputational impacts. This research project aims to design a secure multi-factor authentication (MFA) model tailored to the financial sector, in order to reduce vulnerabilities associated with digital authentication. The proposed model integrates modern technologies such as FIDO2, adaptive authentication, and Zero Trust architecture, and aligns with international standards including NIST SP 800-63B, ISO/IEC 27001, and OWASP ASVS. The model is validated using established cybersecurity tools such as OWASP ThreatDragon, OWASP ZAP, and Kali Linux in a simulated environment that emulates real attack scenarios. The adopted research methodology is mixed in nature, combining qualitative and quantitative analysis. It includes phases such as threat identification, risk modeling, architecture design, technical implementation, and validation through penetration testing and attack simulations. The expected results include a reduced success rate of simulated attacks, improved user experience, and a strengthened security posture for institutions implementing the model. This work contributes to the development of robust authentication practices in the financial sector by offering a practical, replicable solution aligned with current digital security challenges.