What is Multi-Factor Authentication and why does my business need it?

Multi-factor Authentication (MFA) is an authentication method that requires the user to provide two or more verification factors to gain access to a resource such as an application, online account, or a VPN. MFA is a core component of a strong identity and access management (IAM) policy and should be adopted into your business as a standard practice to help avoid Cyber threats.

Why is MFA so important?

The reality is that employees do fall for phishing scams and reuse a small pool of simple, easily guessed passwords across personal and corporate accounts.  If you are not using MFA therefore, your organisation is wide open to attacks. One of the biggest security threats today is the risk of compromised credentials.

Multi-factor authentication should be used whenever possible.  It immediately neutralises the risks associated with compromised passwords by adding an additional layer of security to protect highly sensitive personal information.

Tech giants Microsoft state that providing an extra barrier and layer of security makes it incredibly difficult for attackers to gain access, “MFA can block over 99.9 percent of account compromise attacks”.  MFA primarily prevents any attack that results from a cyber-criminal obtaining or guessing the user’s credentials… In fact, MFA prevents more than 96% of bulk phishing attempts and more than 76% of targeted attacks, according to Google.

What is MFA and how does it work?

When you enable MFA, you have two or more layers of verification.  For example, when you log in or sign into an account, you are prompted to authenticate by entering a username and password – this is the first verification layer.  MFA authentication works as an extra step in the process and as a second security layer that will reconfirm your identity.  Its purpose is to make an attacker’s life harder to access your account and data, therefore resulting in a breach.

There are three main authentication factors:

• Something you know – i.e. your password, PIN number or an answer to a personal question
• Something you have – i.e. a physical device such as your mobile phone
• Something you are – this is the biological factor so could be face or voice recognition, fingerprint or retina scan

It may seem like a hassle, especially when you are setting up these multiple verification methods, or if you need to run to find your phone for that text message code. MFA seems inconvenient, but it is making your accounts even securer by requiring multiple pieces of information or identification from you. This lessens the likelihood that someone will have all the pieces of data they need to hack an account.

Why should I activate MFA?

The reality is that many traditional cybersecurity measures can be compromised without MFA. Anti-virus software, firewalls, encryption tools, network monitoring solutions, and more can all be bypassed if hackers compromise them and gain credentials to privileged user accounts. 

Passwords on their own are not as secure as we need them to be.  Professional hackers can test billions of password combinations in seconds and often people use the same password for everything – mixing (and risking) both personal and corporate accounts in the process.

Security questions are also very easy for cyber criminals to answer, as so much of our lives are now published on social media platforms and easily accessible to all.

A hacker may have your username and a list of your commonly used passwords, but if they do not have the third or fourth verification steps, they will be stopped in their tracks. By enabling MFA, email accounts on services such as Office 365 are much more secure and difficult to hack. 

Cyber security measures such as MFA are not just for enterprise businesses. Small businesses are also being targeted at a growing rate by cyber criminals. In addition, Directors and highly privileged user accounts are a top target for hackers. MFA can be used specifically for administrative and executive accounts to protect them.

Cybercrime is about more than just stealing data. With MFA, you are also attempting to stop attackers from destroying data, changing programs, and using your accounts to transmit propaganda, spam, or malicious code.

MFA is already becoming a universal normal. People are now accustomed to authentication procedures in their personal as well as professional lives. Social media, banking, gaming, and email platforms have all rapidly adopted MFA. Bringing it into your workplace is a necessity.

MFA is simple and relatively easy for businesses to implement. Contact Lumina today to discuss your IT security and MFA requirements.