Keep your credentials out of the wrong hands by enabling multi-factor authentication (MFA). It’s the best way to prevent yourself from having your credentials leaked or stolen.
MFA is a security system that verifies a user’s identity by requiring multiple credentials. Rather than just asking for a username and password, multi-factor authentication requires additional pieces of evidence, usually knowledge (something the user and only the user knows, like a unique password), possession (something the user and only the user has, such as a security token), and inherence (something the user and only the user has, like a fingerprint).
Two-factor authentication (2FA) is a type of multi-factor authentication. It confirms users’ claimed identities by using a combination of two different factors: something they know (password) and a second factor, generally repeating back a code sent over SMS or a number generated by an app. It’s worth it to add the extra step to your basic log-in procedure.
People who don’t take advantage of the extra layer of defence, and find themselves hacked, have a much harder time regaining access to their own account. This is because online crooks enable multi-factor options themselves and tie your account to a device they control.
Not enabling MFA is much riskier for people who tend to reuse the same passwords for multiple sites. Keep in mind that any service to which you’ve given sensitive information may have their data breached. In January 2019, Marriott Hotels confessed to a record-setting breach after hackers accessed the records of up to 383 million guests, including credit card information and
approximately 5.25 million guests’ unencrypted passport numbers. In April, Facebook made the news when 540 million records were out in the open on an unprotected public storage server, which exposed users’ names, IDs and passwords. There are plenty more examples in CNET’s 2019 Data Breach Hall of Shame. According to research from Risk Based Security, the total number of data breaches was up 33% over last year, with 5,183 data breaches and a total of 7.9 billion exposed records. By November, the research firm called 2019 the “worst year on record” for breaches.
Take a look at twofactorauth.org for lists of (hundreds) of websites that have MFA available. Some offer one-time codes sent via email, phone calls, SMS or a mobile app, to more robust authentication options like a true 2FA option. Email, SMS and app-based one-time code options are considered less secure since they can be subverted by certain long-standing attack scenarios, from SIM-swapping to mobile-based malware.
It just makes sense to secure your, and your employees, accounts with a strong form of MFA and include it in your company policies. Make it a standard procedure to protect company credentials from hackers who have either stolen a password database or used phishing campaigns to obtain passwords. As your trusted IT Partner, WW Works can help your organization implement this additional security layer to improve online safety.
Be Safe, Not Sorry!
