Multi-factor authentication for small business teams

Multi-factor authentication is a second step at login that proves you are really you, and it is the single best fix for stolen passwords. A password alone can be guessed, leaked or tricked out of a person. A second check, such as a code on a phone or a small key you plug in, stops most attackers even when they hold the password. Small firms can switch it on in about a week, and most tools already include it.

What multi-factor authentication means

Every login check falls into one of three groups. Something you know, like a password. Something you have, like a phone or a security key. Something you are, like a fingerprint. Multi-factor authentication asks for proof from at least two groups. The US standards body NIST describes a multi-factor authenticator as one that needs two factors in a single login.

Two passwords do not count. They are both things you know. A password plus a code from your phone does count, because the code comes from something you have.

NIST also makes one point that surprises people. Unlocking your phone with a fingerprint or a PIN is not counted as a login factor by itself. The service you sign in to cannot tell whether the phone was locked, or how it was unlocked.

Sources: NIST, Digital Identity Guidelines: Authentication and Lifecycle Management, SP 800-63B, 2017 (pages.nist.gov/800-63-3/sp800-63b.html).

Why a second step blocks most takeovers

Most account break-ins start with a stolen or reused password. People reuse the same password on many sites. When one site leaks, attackers try the same login everywhere else. A second factor breaks that chain, because the attacker has the password but not the phone or the key.

Microsoft studied this in its own systems. In a July 2019 post, its identity security team said an account with multi-factor authentication turned on is more than 99.9 percent less likely to be compromised than one without it. That is a company figure from its own service, so treat it as a strong sign, not a promise. The direction is clear. The second step stops a very large share of attacks.

Sources: Microsoft Azure Active Directory Identity Blog, "Your Pa$$word doesn't matter," 9 July 2019 (techcommunity.microsoft.com).

Pick the right kind of second factor

Not all second steps are equally strong. Here is a simple order, from best to acceptable.

• Hardware security keys. These are small physical devices that you plug into a port or tap on a phone. They resist fake login pages.
• Authenticator apps. A phone app that displays a six digit code that changes every 30 seconds, or asks you to approve a sign-in.
• Text message codes. Better than nothing, but the weakest of the three.

NIST labels text and voice codes as "restricted." It says they carry extra risk, and that a service should check for signs such as a recent SIM change before it trusts them. Thieves can sometimes move a phone number to a new SIM card and then receive the codes. NIST also says email and internet phone numbers should not be used for this kind of check, because they do not prove you hold a particular device.

NIST also notes that a fake website can capture a password and a code typed into it. Methods that tie the login to the real site, such as security keys, resist that trick. For a small firm, the practical advice is simple. Use an authenticator app by default. Buy security keys for the owners and anyone who handles money.

Sources: NIST SP 800-63B, 2017, sections on out-of-band authenticators and verifier impersonation resistance (pages.nist.gov/800-63-3/sp800-63b.html).

Roll it out in one week

You do not need a project team. Follow these steps in order.

1. Day one: list every account that touches money, customer data or email. Start with email, banking, payroll, accounting software, cloud storage and your website host.
2. Day two: turn it on for the owners and managers first. Their accounts have the most power, so attackers want them most.
3. Day three: switch on the setting for everyone else. Most business email and file tools let an administrator require it for all staff.
4. Day four: help people set up an authenticator app. Sit with each person for five minutes. Most problems appear here.
5. Day five: print or save backup codes and store them in a locked place, such as a safe.

Tell staff why you are doing it. A short note works: "Passwords get stolen. This second step protects your pay and our clients." People accept a small delay at login when they understand the reason.

Handle lost phones and new hires

Plan for the day someone loses a phone. Without a plan, that person is locked out, and a rushed fix can open a hole. Decide in advance who can reset a login and how they confirm the request. A phone call to a known number is better than an email that anyone could send.

Keep a short list of who has which devices. When a person leaves, remove their access the same day and take back any security key. When a person joins, set up the second step before you give them access to client files.

Keep backup methods too. Give each key holder a second method, such as a spare key kept in the safe. Then one lost device does not stop the business.

Do not forget the password itself

The second factor is a safety net, not a reason to keep weak passwords. NIST advises allowing long passphrases, at least 64 characters. It says to check new passwords against lists of leaked ones, and to skip forced changes on a fixed schedule unless there is a sign of a breach. It also advises against strict rules that demand odd symbols, since they push people toward easy patterns.

A password manager helps here. It creates a long, unique password for each site, so one leak cannot open other doors. Pair it with multi-factor authentication and you have covered the two most common ways accounts are lost.

This is general information only. It does not replace advice from an IT provider who knows how your own accounts, staff and software are set up.

Sources: NIST SP 800-63B, 2017, sections on memorized secrets (pages.nist.gov/800-63-3/sp800-63b.html).

Sources

• NIST, Digital Identity Guidelines: Authentication and Lifecycle Management, SP 800-63B (pages.nist.gov/800-63-3/sp800-63b.html)
• Microsoft Azure Active Directory Identity Blog, "Your Pa$$word doesn't matter," 9 July 2019 (techcommunity.microsoft.com)