Cloud-Based Information Systems: A Multi-Factor Authentication and User Superficial Security Analysis
Keywords:
Multi-Factor, Security Analysis, Cloud-Based, Authentication, User SuperficialAbstract
Cloud-based information systems (CBIS) are now a core part of how modern organizations run their IT, offering flexible scaling, reliable remote operations, and lower costs. But moving data to the cloud also makes organizations more vulnerable to attacks that target user identities. Multi-Factor Authentication (MFA) is widely used as a first line of defense against unauthorized access, yet it often falls short because of careless user habits, such as approving push notifications without thinking, responding automatically to login prompts, and going through the motions to meet policy rather than paying real attention to security. This quantitative study examined how MFA implementation, shallow user security behavior, and the actual security of cloud data access relate to one another. Using a cross-sectional survey, the researchers gave structured questionnaires to 312 enterprise cloud users in the IT, financial, and healthcare sectors. Structural Equation Modeling (SEM) showed that putting MFA in place significantly lowers the risk of basic credential-stuffing attacks (ꞵ = 0.42, p < 0.001). However, when users treat security superficially, authentication becomes less reliable, with a 38% rise in vulnerability to MFA fatigue and phishing proxy attacks (ꞵ= -0.38, p < 0.001). The study also found that habituation to security prompts plays a key mediating role in identity breaches. The authors conclude that technical authentication tools alone cannot keep cloud information secure unless the human side of the problem is also addressed. They recommend Context-Aware Adaptive MFA, ongoing behavioral analytics, and security awareness training built to reduce habituation and mental fatigue.
References
1. Adeboye, O. K., & Williams, P. T. (2020). Beyond passwords: Evaluating the efficacy of multi-factor authentication in corporate cloud environments. Journal of Cybersecurity and Data Protection, 12(3), 145–162.
2. Al-Hassan, M., Al-Fuqaha, A., & Rayes, A. (2022). Human elements in cloud security: A survey on user habits, fatigue, and threat perception. IEEE Access, 10, 48211–48229.
3. Al-Maroof, R. S., Alhumaid, K., & Salloum, S. A. (2021). Acceptance of cloud computing systems in higher education: A systematic review. International Journal of Information Management Data Insights, 1(2), 100028.
4. Bello, A. O., & Mensah, K. A. (2021). The cognitive burden of security compliance: An empirical evaluation of employee authentication habituation. Computers & Security, 108, 102341.
5. Chen, Y., Zhang, L., & Liu, X. (2023). Zero trust security frameworks in enterprise cloud systems: A multi-layered identity approach. ACM Transactions on Privacy and Security, 26(2), 1–24.
6. Chinedu, P.U.; Maduabuchukwu, C.; Oghorodi, D.; & Nazrul Islam, M.S. (2025). Moving to the Cloud: A Review of the Impact and Strategies for Nigeria Digital Transformation. Nigerian. Journal of Engineering Science and Technology Research, 11(1): 251-257.
7. Foster, R., Gupta, S., & Vance, A. (2024). Context-aware authentication design: Reducing user friction while maintaining security integrity. International Journal of Human-Computer Studies, 181, 103150.
8. Gupta, A., & Martinez, C. (2022). Bridging the gap between cryptosystems and human behavior in cloud access management. Journal of Information Security and Applications, 68, 103210.
9. Johnson, M. R., & Zhao, H. (2021). Identity as the new security perimeter: Evaluating identity and access management in distributed cloud architectures. Cloud Computing and Security, 15(4), 312–329.
10. Kowalski, P., Nowak, M., & Wiśniewski, A. (2025). Adversary-in-the-middle (AiTM) phishing and MFA bypass techniques: Mechanics, mitigation, and empirical analysis. IEEE Transactions on Information Forensics and Security, 20, 1142–1156.
11. Li, H., Wang, Z., & Chen, J. (2022). Risk-based dynamic access control for enterprise multi-cloud environments. IEEE Transactions on Cloud Computing, 10(3), 1890–1903.
12. Nduka, C. E., & Abubakar, S. I. (2020). Superficial compliance versus actionable security: Analyzing user behavior in enterprise systems. African Journal of Information Systems, 12(1), 45–68.
13. O'Connor, S., & Evans, D. (2025). MFA prompt bombing and push notification fatigue: Quantifying enterprise security exposure. Computers & Security, 148, 104112.
14. Okonkwo, C. J., & Smith, J. L. (2023). Multi-Factor Authentication protocols: Evolution, vulnerabilities, and future directions in cloud environments. Cybersecurity, 6(1), 12.
15. Ramesh, U., & Kumar, P. (2021). User and entity behavior analytics (UEBA) in cloud environments: A machine learning approach to threat detection. Journal of Network and Computer Applications, 193, 103198.
16. Sorenson, K., & Larsson, E. (2022). Evaluating FIDO2 WebAuthn adoption in corporate IAM architectures. Information & Computer Security, 30(5), 712–728.
17. Thompson, E., & Davis, R. (2023). Social engineering the authentication layer: How fatigue attacks compromise multi-factor systems. Journal of Cybersecurity, 9(1), tzad004.
18. Toussaint, L., & Dubois, M. (2022). Balancing usability and security in cloud authentication interfaces: An empirical study. Interacting with Computers, 34(3), 201–215.
19. Williams, B., Taylor, K., & Miller, S. (2024). Dual-process psychological theory in cybersecurity: How system 1 thinking degrades authentication security. Human Factors, 66(2), 489–504.
20. Zhang, W., & Patel, N. (2024). The human perimeter: Analyzing post-MFA security risks in cloud infrastructure. IEEE Security & Privacy, 22(1), 34–43.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Author(s)
This work is licensed under a Creative Commons Attribution 4.0 International License.
Articles published in the Journal of Advanced Multidisciplinary Studies (JAMS) are licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0), unless otherwise stated. Authors retain copyright of their work and grant JAMS the right of first publication.
