What is multi-factor authentication, and should every business account use it?
Multi-factor authentication (MFA) means signing in with two or more kinds of proof, such as a password plus a code from an app or a physical key, so a stolen password alone is usually not enough. CISA recommends requiring it wherever possible, starting with admin accounts and people who handle sensitive data, and ranks text or email codes as the weakest of the methods it lists. It is usually worth turning on for any account that offers it.
What it means
CISA says strong passwords help but are no longer enough on their own. It says MFA adds "an extra layer of protection" by requiring "two or more ways to verify" who is signing in. CISA also calls MFA a simple step that "can block many common cyberattacks".
As general advice, the second proof is usually something you have, such as a phone or a key, or something about you, such as a fingerprint.
The types CISA names, strongest first
CISA says "Any MFA is better than none", and lists the main options from most to least secure.
- A physical security key that plugs in or taps your device. CISA says it gives the best protection against phishing.
- An authenticator app with number matching: the app sends a prompt to your phone and you enter a number shown on the sign-in screen.
- An authenticator app with a one-time code that changes every 30 seconds.
- Biometrics, meaning your fingerprint or face. CISA says these are usually specific to one device and work best with another method.
- A text or email code. CISA says this is the most familiar form but gives the weakest protection, and to use it only if stronger options are not available for that account.
Which accounts to start with
CISA says to require MFA wherever possible, and to work with your IT team or provider to turn it on across systems such as email, file storage and remote access. It says to start with admin accounts and employees who handle sensitive data. It also encourages employees to turn it on for their personal accounts.
As general advice, add the accounts that can reset others or move money: business email, the bank, payment and accounting tools, and advertising accounts. The related answer on a hacked business email account lists turning on two-step sign-in among its steps.
Plan for a lost phone
These steps are general advice, not CISA's. Doing the first three before a phone goes missing lowers the risk of being locked out. The related answers on Google Workspace or Microsoft 365 and on managed IT support cover keeping a second admin and what a provider handles for accounts.
- Where the service allows it, set up a second method and save the backup codes it offers somewhere other than the phone.
- Keep at least two trusted people with their own admin sign-ins, so one lost phone does not lock everyone out.
- Before replacing or wiping a phone, check how its authenticator app moves to the new one, since some do not move on their own.
- If a phone is lost, tell your administrator or provider at once, change the password from another device, and ask for the lost phone to be removed as a sign-in method.
Sources
Related answers
- What should you do if your business email account is hacked?
- Google Workspace or Microsoft 365: which should a small business use for email?
- What is managed IT support, and what should it include?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.