Phishing, reused passwords and data breaches at other sites all expose credentials. A second factor means a stolen password alone is not enough to sign in.
Why multi factor authentication should come first
Of all the security controls a small business can add, this one gives the most protection for the effort.
Multi factor authentication asks users for a second proof of identity, such as an app prompt or a hardware key, in addition to a password. It is one of the most effective controls against account takeover.
Passwords get stolen
Where to turn it on
Start with email, remote access and administrator accounts, then extend to every business application that supports it.
- Email and office suite accounts
- VPN and remote desktop
- Cloud provider consoles
- Finance and payroll systems
Choose stronger methods
App based prompts and hardware security keys resist phishing better than SMS codes. Use them where possible, especially for administrators.
