...Right?
Whether or not you perused our previous blogs, you likely have at least some concept of the differences between single, two-factor, and multifactor authentication. And while it makes sense that more factors = more security, questions may still linger. Questions like, ‘should my business actually be using MFA?’, ‘does MFA save my business money?’, and, most importantly, ‘how do I get my team to buy into the extra steps of MFA?’.
We’ll answer all of those questions and more in this blog, including reflecting on what makes MFA superior to alternative methods of protecting your information and ending with some tips that make MFA more convenient for your team.
Okay, as much as we love to think every single one of you printed and forwarded our last blog to everyone in your business sphere, that’s probably not the case – so let’s start back at the beginning to quickly refresh our knowledge on the topic.
Depending on how secure your data already is, your team is likely utilizing at least a two-factor authentication process, meaning users are required to enter more than just a password or PIN to enter an account. For these more secure accounts, you’re essentially asking whoever is logging in to prove they’ve got more than just one factor of authentication.
The difference between single-factor, two-factor, and multifactor authentication, then, is a pretty simple one: How many of these factors are required to gain access to your business’ data? Typically, the more secure the data, the more factors are required.
Single-factor is inferior due to the ease of compromise – essentially, if someone can figure out your four-digit PIN or simple password, they’re in, and that’s just way, way, WAY too risky.
So what about 2FA? Well even if you weren’t trying to protect troves of data, you’ve likely been a part of a 2FA system through your bank card (PIN & ZIP Code) or another kind of secondary authenticator app that provides unique identification codes. But 2FA has its downfalls, and you can look no further than Twitter CEO Jack Dorsey when it comes to that problem.
So while 2FA is absolutely better than nothing, it should be a little more than a start if you’re serious about protecting your data. But because there are overlapping factors that can easily be exploited together, MFA is the superior choice.
Should my business be using MFA?
If your business is collecting data, you have a legal requirement (like hundreds of different laws) to protect it from exploitation. It’s up to you to decide how serious you are about protecting your customers, clients, employees, and community… but that’s kinda your call, huh? (YES, YOU SHOULD BE USING IT!)
Does MFA save my business money?
You may be wondering about adding more third-party SaaS connections, but the legwork is worth the truly minimal hassle. Some cyber insurance providers actually offer incentives for having MFA enabled on your account due to how effective MFA is in the event of a breach!
But what if your data was kept safe behind a true MFA approach that wasn’t just secure, but also easy to use? Multifactor authentication is great – like GREAT GREAT… it has been shown to protect against 100% of all automated bot attacks, great – but without the buy-in of the people who need to utilize and leverage the systems for their own protection, there’s no hope for any kind of true security for your data.
Whatever the additional ask, there’s undoubtedly some kind of pushback. Even something as simple as a personal password generator attached to a keychain can produce some eye rolls. (Not naming any names, Jennifer..)
It is sometimes difficult to properly balance convenience with security no matter how important the responsibilities might be, but with new additions to biometrical feedback, especially in mobile devices, meeting multifactor requirements has become infinitely easier. Fingerprint scans, according to the IBM Future of Identity Study 2018, are the more secure inherent (it’s one of the four groups of factors we mentioned in our last blog!) authentication method, and many smartphones offer fingerprint scanners already built into their system.
Some or all of your team may travel often and could justifiably be worried about their availability and access when in the air. Authenticator apps utilize all-important MFA systems, allowing your team to connect smartphones and tablets even while they’re technically offline. As long as you set up the app, which both Google and Microsoft offer for Android and iOS, ahead of time, your secure connections should be seamless.
And no matter what Jennifer might say, solutions like security keys and fobs are simple, easy-to-carry solutions for just about every business.
It shouldn’t matter how seriously you’ve taken security in the past, there’s always room for improvement, especially in a marketplace that changes so quickly. And while adding factors to your authentication process may seem daunting, after weighing the risk and rewards for so many convenient ways to protect your customer data it’s an easy choice.
For more information on important security topics like these, sign up for our regular newsletter and follow PTG on social media!