MFA Adoption During War: Ukrainian Government Mandate and Progress

Multi-factor authentication has been described by CISA and its Ukrainian counterpart SSSCIP as the single most impactful defensive control available against credential-based attacks—the dominant initial access vector used by Russian state-sponsored threat actors against Ukrainian targets. Despite this clear priority, rolling out MFA across a wartime government with displaced personnel, damaged infrastructure, and legacy systems has been a formidable logistical and technical challenge.

The Government MFA Mandate

Ukraine's mandatory MFA requirement for government employees accessing classified or sensitive systems took effect in stages beginning in 2022, with full enforcement for all Tier-1 systems completed by mid-2023. The mandate specifies that MFA must be phishing-resistant—explicitly excluding SMS-based OTP codes, which are vulnerable to SIM-swapping attacks and SS7 network interception, both techniques documented in Russian threat actor playbooks. Approved MFA methods include FIDO2 hardware security keys, TOTP authenticator apps (classified as acceptable but not preferred), and emerging passkey implementations.

Enforcement is technically implemented through conditional access policies in Microsoft Entra ID and equivalent mechanisms in other identity platforms. Attempts to authenticate to covered systems without completing the MFA step result in immediate denial, with no override capability short of a formally documented break-glass procedure. This hard enforcement, while operationally disruptive during the rollout period, eliminated the possibility of MFA bypass through help-desk social engineering—a technique extensively used against Ukrainian targets in pre-war years.

FIDO2 Hardware Key Distribution

Western partners, primarily coordinated through the US State Department's Bureau of Cyberspace and Digital Policy and the UK NCSC, supplied thousands of FIDO2 hardware security keys to Ukrainian government agencies between 2022 and 2025. Yubico YubiKey 5 series and Google Titan keys were the most commonly supplied models. Distribution proved logistically complex—matching keys to specific users, registering keys in identity management systems, and providing training had to be accomplished partly in active conflict zones with limited reliable communications infrastructure.

A priority tier was established for key allocation: intelligence and national security personnel received hardware keys first, followed by critical infrastructure operators, then general government IT staff. Personnel operating in frontline areas or those whose location was operationally sensitive received keys via field distribution networks rather than standard mail, given concerns about interception or delivery failure.

Soft Token Risks in Wartime Context

TOTP authenticator apps (soft tokens) running on smartphones introduce risks that are amplified in wartime conditions. Smartphones are captured by enemy forces; soldiers and officials operating near the front have had devices seized, potentially allowing adversaries to access enrolled authenticator apps. Additionally, SIM-swapping attacks against Ukrainian mobile numbers have been used to redirect SMS codes, compromising accounts relying on SMS-based second factors.

For these reasons, Ukrainian guidance explicitly classifies soft tokens as acceptable only for lower-sensitivity systems and strongly recommends hardware keys for any system containing operational, intelligence, or sensitive personal data. The guidance also recommends that users operating in high-risk physical environments use FIDO2 keys rather than phone-based authenticators, and that backup codes for any enrolled MFA device be stored in a secured physical location rather than on the same device.

MFA Adoption Progress by Sector

Passkey Migration Progress

Passkeys—a FIDO2-based credential format that combines device-bound private keys with biometric or PIN verification—represent the next evolution beyond physical hardware tokens. The Diia government services application began offering passkey enrollment to end users in 2024, making Ukraine one of the few governments globally to offer passkey-based citizen authentication at scale. The migration from password-plus-SMS authentication to passkeys for Diia's citizen-facing services reduced credential-based account takeover attempts by an estimated 85% according to the Ministry of Digital Transformation's security operations data.

For internal government employee authentication, passkey migration faces the challenge of legacy system compatibility—many back-office systems support only username/password authentication and require application modifications to accept FIDO2 credentials. A multi-year remediation program funded partly through EU digital assistance is systematically updating these legacy applications, prioritizing those handling personal data or national security information.

FAQ

Why is SMS-based OTP excluded from Ukraine's approved MFA methods for sensitive systems?

SMS OTP is vulnerable to SIM-swapping and SS7 network interception attacks, both documented in Russian threat actor operations against Ukrainian targets. These attacks allow an adversary who intercepts SMS messages to complete MFA challenges without the legitimate user's involvement.

How many FIDO2 hardware keys have been distributed to Ukrainian government employees?

Exact figures are not publicly disclosed for security reasons, but Western partner programs supplied tens of thousands of keys between 2022 and 2025, with priority allocation to national security, intelligence, and critical infrastructure personnel.

What happens if a Ukrainian government employee loses their hardware security key?

The lost key must be immediately reported and deregistered from all enrolled systems. The employee uses a pre-registered backup method (typically a second hardware key or a one-time emergency code) while a replacement is procured.

Are passkeys the same as FIDO2 hardware keys?

Both use FIDO2 standards but differ in implementation. Hardware security keys are physical devices; passkeys are device-resident credentials stored in a smartphone or computer's secure enclave, unlocked by biometric or PIN. Passkeys offer greater convenience but are tied to specific devices rather than portable tokens.

How did the Kyivstar breach relate to MFA failures?

Post-breach analysis indicated that MFA was not enforced for certain remote access sessions, allowing stolen credentials alone to grant network access. This finding was a primary driver of Ukraine's subsequent hard-enforcement approach to MFA mandates.

Sources

1. SSSCIP Ukraine — "Multi-Factor Authentication Requirements for Ukrainian Government Systems," 2023 circular
2. US State Department Bureau of Cyberspace and Digital Policy — "Hardware Authentication Key Distribution Program: Ukraine," 2024
3. Yubico — "Supporting Ukraine's Digital Resilience: YubiKey Distribution Program," case study 2024
4. Ukraine Ministry of Digital Transformation — "Diia Passkey Launch: Security Impact Report," 2024
5. CISA — "More Than a Password: The Case for Phishing-Resistant MFA," 2023 guidance