The short version.
Yes, MFA is possible for service accounts and industrial devices. It relies on machine credentials and secure gateways instead of a person entering a code.
Service accounts authenticate with digital certificates or OAuth tokens, because no human is present to approve a prompt. Many PLCs and SCADA devices cannot run modern authentication, so MFA is enforced at a secure gateway in front of them. Privileged access management rotates service account credentials and grants just-in-time access.
Why MFA is harder for machines
Why service accounts cannot answer an MFA prompt
Service accounts let applications, automated processes and scripts log in to other services and systems. A user account has a person behind it. A service account usually runs with no one present, which makes MFA harder in three ways:
- No one to respond: A service account has no user to type a code, so SMS or app-based verification does not work.
- Uptime requirements: A service account that runs a production process needs uninterrupted access. An MFA step could add delay or stop the process.
- Complex access patterns: A service account often holds permissions on several systems, and each one has to accept the new authentication method.
Why PLCs and SCADA devices cannot run MFA
Industrial devices, such as PLCs (Programmable Logic Controllers) and SCADA (Supervisory Control and Data Acquisition) systems, run the process itself, and they bring their own limits:
- Legacy systems: Many industrial devices run old technology that does not support modern authentication protocols.
- Resource constraints: These devices often have too little processing power and memory to run extra security functions like MFA.
- 24/7 operations: The plant runs around the clock, so an authentication failure that stops a device is not acceptable.
How to apply MFA to machines and devices
MFA for service accounts
To secure service accounts, use these methods:
- Token-Based Authentication: Use tokens that the application stores and manages securely, such as OAuth tokens, in place of usernames and passwords.
- Certificate-Based Authentication: Give each service account a digital certificate for machine-to-machine communication. This method matches NIST 800-171, which calls for cryptographic methods.
- Privileged Access Management (PAM): Use a PAM tool to manage service account credentials. It rotates passwords automatically and grants just-in-time access, so a stolen credential stops working sooner.
MFA for industrial devices
When a device cannot run MFA itself, put MFA in front of it:
- Network Segmentation: Use microsegmentation to isolate devices and control access through secure gateways that support MFA. This follows the IEC 62443 model of zones and conduits.
- Gateway Authentication: Enforce MFA at the network edge or at a secure gateway, so only authenticated traffic reaches the industrial devices.
- Firmware and Software Updates: Where possible, update device firmware to a version that supports modern authentication. You may need to ask the vendor to add it.
Apply Zero Trust to machine accounts
Zero Trust ("never trust, always verify") applies to service accounts and industrial devices as well as to people:
- Continuous Verification: Check authentication throughout the session, beyond the first login. Behavioral analytics and anomaly detection can do this.
- Least Privilege Access: Give each service account and device only the permissions it needs for its job. A compromised credential then does less damage.
What to do next
MFA for service accounts and industrial devices is possible, but it uses different mechanisms than MFA for people. Use certificate-based authentication for machine-to-machine communication, token-based authentication (OAuth) for service accounts, and gateway-based MFA for industrial devices that cannot authenticate themselves. Add Privileged Access Management for credential rotation and just-in-time access. The goal is the same as for people: one stolen credential must not open a critical system.