Why You and Your West Michigan Business Need to Enable MFA Today
Key Points in This Article:
- Multifactor authentication (MFA) is a critical component of cybersecurity for businesses and individuals.
- MFA requires users to authenticate online accounts in multiple ways, making it harder for criminals to access their accounts.
- Both businesses and individuals should enable MFA for every account they hold with a third party to safeguard sensitive data.
Multifactor authentication (MFA) is one of the essential tools to protect our accounts from being hacked. Unfortunately, too many businesses and individuals either neglect or circumvent this simple measure. And they often find out the hard way that their accounts are less secure than they thought.
What is MFA?
MFA refers to an authentication method that only grants users access to their email or application account after they present two or more authentication factors. An authentication factor may be something a user knows, has, or is. MFA also has increasingly employed location-based authentication as a secondary factor.
Most commonly, MFA starts by prompting a user for an authentication factor the user knows. Such a factor might be a password, PIN number, or similar access credential the user is aware of. Passwords alone are not enough to keep an account secure, especially as many users don’t use complex, hard-to-guess passwords, nor do many companies require them to. Further, many people use the same passwords for multiple accounts, increasing their possible exposure in the event of a data breach.
Businesses often don’t require employees to change corporate devices’ default passwords when issued. In fact, it’s only after a successful cyberattack that some companies learn that multiple employees share the same default password (often easy to guess) for their devices and email accounts.
Even when people employ multiple, hard-to-guess passwords and change them regularly (and when employers and third-party institutions force them to), this single authentication factor is insufficient to safeguard sensitive data.
When MFA is enabled, the user is prompted to input a secondary authentication factor after inputting their password. For example, a user may be prompted to swipe a key card or input a security token after entering a password. These are examples of authentication factors involving something the user has in their possession. A criminal with an individual’s password would not be able to log in if they also did not have access to the required key card or similar authentication factor.
Alternatively, a user may be prompted to use an authentication factor involving biometric characteristics, such as inputting one’s fingerprints into a scanning application. Biometric authentication also presents a complex barrier for a criminal to overcome.
MFA sometimes employs the use of a third-party authenticator (TPA) app. These apps typically generate a code that is then pushed to a user’s smartphone or another device the user has, which they must then enter as well.
Why Enabling MFA Is Essential
While MFA is not foolproof, it can make it much harder for a criminal or scammer to compromise a user’s account. Criminals may obtain your password if a company with your password suffers a data breach. Consider the number of companies and organizations where you have password-protected online accounts:
- Your employer
- Social media applications you use
- Your Internet Service Provider
- Your email provider
- Cloud-based storage applications you use
- Your financial institutions
- Healthcare providers
- Educational institutions
- Online retailers, you frequent
It’s a long list. And if any of these companies are compromised, your passwords could be used or sold on the dark web. And with it, plenty of personal and sensitive information.
Further, like most people, you use the same password for multiple online accounts. In the event of a data breach, you’ve potentially increased the access criminals have to your personal information.
Criminals don’t simply wait for passwords to become available for sale on the dark web. Some criminals will use applications to launch what is known as a brute-force attack. These attacks use trial and error to guess your password. And the applications criminals use can generate possible password combinations at a rate far faster than a human can. Sometimes, these applications can access targeted accounts in just a few days.
But when companies enable MFA, criminals who have your password only have one authentication factor. They don’t have everything they need to access your accounts. And without those additional authentication factors, you and your business may be able to avoid identity theft, a data breach, or worse.
MFA is not foolproof, as consumers and businesses who enable MFA remain vulnerable to some phishing efforts, as well as malware, ATM skimming, man-in-the-browser, and man-in-the-middle attacks. But compared to accounts secured by a password, they are far more secure.
Why Individuals and Businesses Need to Enable MFA Now
To keep your information secure, you need to list all your online accounts that store sensitive information, then check to see if those accounts can enable MFA. Some companies enable MFA by default. And many companies do offer customers the ability to turn on two-factor or multifactor authentication. Often, we don’t feel like taking the extra step to authenticate our accounts and ignore this option. But if you aren’t taking advantage of MFA, you should enable it now to protect your financial and other critical information.
It’s also critical for businesses to enable MFA for customers. Not only can MFA make it harder for criminals to access customer data, but it can also signal to prospective consumers that their data is in good hands. That assurance is especially important in the B2B space, with businesses placing their financial, proprietary, and customer information into the hands of a third party.
Businesses must also ensure that their employees are engaged with vendors and suppliers with MFA enabled. And if MFA is an option, employees should be using it. Consider an employee who’s opened an online account with a supplier on behalf of your company and has your credit card information stored. If your employee has the option to enable MFA but doesn’t, then your credit card information is more vulnerable when cybercriminals target the supplier.
Finally, businesses must establish and reinforce strong password policies that require employees to use hard-to-guess, complex passwords and to change them frequently. These policies, coupled with MFA, can help safeguard critical business and employee data from criminals.
Envizion IT is an IT solutions company based in Zeeland, MI. Envizion draws its guiding values from biblical principles and uses a “lean approach” to IT that reduces customer costs by continually improving customer systems and the environment.