To prevent the issuance of an MFA bypass code to an attacker posing as an employee, implementing identity proofing would be most effective. Identity proofing involves verifying the identity of individuals before granting access or providing sensitive information.
Identity proofing: Ensures that the person requesting the MFA bypass is who they claim to be, thereby preventing social engineering attacks where attackers pose as legitimate employees.
Hardware token MFA: Provides an additional factor for authentication but does not address verifying the requester's identity.
Biometrics: Offers strong authentication based on physical characteristics but is not related to the process of issuing MFA bypass codes.
Least privilege: Limits access rights for users to the bare minimum necessary to perform their work but does not prevent social engineering attacks targeting the service desk.