Which authentication controls best fit high-trust executive support?

Abstract

Executive assistants often coordinate email, documents, calendars, travel, and approvals, making account compromise consequential even when the assistant is not a system administrator. NIST distinguishes phishing-resistant cryptographic authentication from manually entered one-time codes, and CISA advises businesses to aim for phishing-resistant MFA [1][2][3][4]. The evidence supports prioritizing high-impact accounts while retaining recovery, delegation, and incident controls.

Methodology

The analysis compares current NIST digital identity requirements with CISA small-business guidance, federal phishing resources, FBI business-email-compromise material, zero-trust architecture, and incident-response recommendations [1][2][3][4][5][6][7][8][9][10]. Technical standards are applied as design references, not as proof that any single authenticator prevents every attack.

Why executive support accounts deserve priority

FBI and IC3 material shows that business-email-compromise schemes exploit trusted communications and changes to payment or account details [7][8]. Executive support accounts can carry relationship context and apparent authority. A risk inventory should rank email, identity, file storage, travel, finance-adjacent workflows, and administrative consoles by the consequence of unauthorized access.

Phishing resistance is a protocol property

NIST defines phishing resistance around cryptographic binding that prevents an impostor verifier from reusing authentication output [2]. Manually entered OTP codes are not classified as phishing-resistant because they can be relayed. This distinction helps teams compare controls without relying on brand claims or user vigilance alone.

Adoption needs delegation and recovery design

CISA recommends requiring MFA broadly and starting with administrative accounts and people handling sensitive data [4][5]. Executive offices also need named identities, native delegation, two registered authenticators where appropriate, documented recovery, prompt revocation, and backup coverage. A stronger sign-in that strands the only qualified assistant during travel is not a complete operating design.

Authentication does not replace transaction verification

Zero-trust guidance treats identity as one part of access decisions [9]. Sensitive changes still require appropriate authorization, independent verification, least privilege, and logging. A valid login does not prove that a request is legitimate, that the actor has approval authority, or that a destination account is correct.

Limitations and review measures

Standards specify desired properties but do not publish a universal executive-office loss reduction for one authenticator [1][2][3]. Review enrollment coverage, phishing-resistant coverage, shared-account count, recovery-test success, access exceptions, revoked-user timing, and incident reports. Qualified security owners should approve risk levels and investigate active incidents [10].

Key findings

  • NIST separates phishing-resistant cryptographic methods from manually entered OTP methods [2].
  • CISA advises businesses to aim for phishing-resistant MFA and prioritize sensitive access [4].
  • Executive office adoption requires usable delegation, recovery, and revocation paths.
  • Transaction verification and least privilege remain necessary after strong authentication [7][8][9].
  • No cited source proves that one authentication method eliminates business-email compromise.

Sources

  1. Digital Identity Guidelines, National Institute of Standards and Technology
  2. Authenticators and Phishing Resistance, National Institute of Standards and Technology
  3. Authentication Assurance Levels, National Institute of Standards and Technology
  4. Require Multifactor Authentication, Cybersecurity and Infrastructure Security Agency
  5. Small and Medium-Sized Business Resources, Cybersecurity and Infrastructure Security Agency
  6. Phishing Guidance: Stopping the Attack Cycle at Phase One, Cybersecurity and Infrastructure Security Agency
  7. Business Email Compromise, Federal Bureau of Investigation
  8. Business Email Compromise: The 55 Billion Dollar Scam, FBI Internet Crime Complaint Center
  9. Zero Trust Architecture, National Institute of Standards and Technology
  10. Incident Response Recommendations and Considerations, National Institute of Standards and Technology

Return to the Research Content library