Multi-Factor Authentication is a Must

Multi-factor authentication

Once you “OWN IT!”, as we talked about last week, you need to “SECURE IT!” This week, we’re focused on multi-factor authentication.

National Cyber Security Awareness Month 2019

Cyber security breaches and hacks are seemingly always in the news these days. Because of that, everyone talks about making sure you have a strong, secure password, so you won’t be a future victim.

What is Multi-Factor Authentication?

While the need for having secure passwords is an absolute must (more on this next week), your password can be compromised. For that reason, multi-factor authentication (or MFA/2-Factor Authentication/2FA) is really what you should be considering. Authentication requires at least one of three ways to ensure that you are who you say you are:

  • Something you know
  • Something you have
  • Something you are

Passwords only use a single factor, something you know. Multi-factor authentication uses the other two facets of authentication along: something you are or something you have. An example of something you have would be an authorized smartphone app or a smart card. An example of something you are is bio-metrics like Apple’s FaceID or fingerprint access.

Multi-Factor authentication means that while an attacker may be able to compromise your password through brute force or phishing campaigns, you have another factor that is required in order to access whatever system or account you need access to.

Whether you are accessing your Facebook page, webmail account, online banking, or your company server resources, multi-factor authentication can often be configured natively or with just a few clicks from an external service. Make sure you look at the privacy and security settings in your account to setup multi-factor authentication wherever possible.

Apps to Use

There are dozens of vendors that provide solutions for two-factor authentication apps for your mobile device. These include Google, Microsoft, LastPass, DUO, etc. Specific sites can also have their own forms of two factor including SMS code and phone call to your mobile number. Keep in mind, these forms of multi-factor authentication have been proven to be less secure in the past including part of high-profile breaches such as the Reddit breach and others.

We work closely with Fortinet for security solutions including FortiTokens as a form of multi-factor authentication. These are either physical or mobile application tokens that provide a one-time password for use alongside your standard password. This allows businesses of all sizes the ability to access company resources securely over remote access VPN or in concert with an identity management system called FortiAuthenticator.

There are simpler methods to improve your security posture and SECURE IT than you may know. It is easier, in an enterprise environment, to implement multi-factor authentication that many people believe. This is a must-do for anyone looking to increase their security posture and help prevent a future breach.