Why multi-factor authentication is vital for security & how to implement it successfully

Today, about 50% of corporate data worldwide is stored in the cloud. Due to the pandemic, many company processes are cloud-based. The cloud offers the “work from anywhere” flexibility that’s required for business continuity.

The number of employees a company has working from home has gone from a slight minority to the majority post-COVID, and this is a trend that’s expected to continue even once the pandemic has passed.

With so much company data and critical processes happening in the cloud, hackers have increased their attacks in this area. In 2020, cloud account attacks have risen 630%.

The accounts that are most susceptible to being breached are those without the important safeguard of multi-factor authentication (MFA). MFA provides a level of protection that has been proven to be effective against brute force attacks, automated bot attacks, and others.

In a study cited by Google on MFA effectiveness, this method of password protection was found to be 76% to 100% effective depending upon the attack type and the kind of MFA being used.

How Does Multi-Factor Authentication Work?

Multi-Factor Authentication adds an additional authentication requirement to gain access to an online account or cloud software access. There are typically three standard forms of authentication:

What you know: This is your username and password combination

What you have: This is something in your possession, like a mobile device that receives an access code

What you are: This is biometrics, like a fingerprint scan

When an account is only protected by one factor – the username/password combination – it is at risk of being hacked. Users often create weak passwords and reuse passwords because they have so many different passwords to keep up with.

When you enable MFA on your accounts, you add a 2nd factor of authentication, which is why MFA can also be called two-factor authentication (2FA)

That additional factor is usually the “what you have” factor, which includes a code sent to a user’s pre-authorized device. The user must enter that code along with their login to gain access to the account.

In a vast majority of cases, the hacker won’t have access to the device used to receive the code, thus they are kept out of the account, even if they have the correct username and password.

Results of Google Study on MFA

Just how effective is multi-factor authentication? It’s very effective at stopping cloud account breaches which is why it’s vital for your cybersecurity.

The results of the Google MFA study found the following percentage of effectiveness based upon the type of attack and the method used to receive the MFA code.

·       Code received by SMS:

o   Automated bot attack: 100%

o   Bulk phishing attack: 96%

o   Targeted attack: 76%

·       Code received by on-device prompt:

o   Automated bot attack: 100%

o   Bulk phishing attack: 99%

o   Targeted attack: 90%

·       Code received through a security key:

o   Automated bot attack: 100%

o   Bulk phishing attack: 100%

o   Targeted attack: 100%

Tips for Successfully Deploying MFA

One of the things that hold companies back from implementing MFA on all accounts is that users aren’t always happy about changing their login habits. They’re afraid that adding another step will be less convenient.

However, with the impact it has on security, not having MFA enabled could be far more inconvenient by way of a ransomware attack or account takeover.

Here are some tips for successfully introducing MFA to your team.

Bring Employees in Early

People are more receptive to a change in their workflow if you bring them in early in the process and give them time to adapt to the idea. If you spring it on them all of the sudden, they’re most likely to resist.

Give Employees a Choice in How to Use MFA

There are three popular ways to receive the MFA code, which are by text message, device prompt, or a separate security key. If you give employees a choice of one of those three methods, they’re more likely to be receptive because they feel they have at least some control over the process.

Use a Single Sign-on Solution

You can address the inconvenience argument against MFA by also introducing a single sign-on (SSO) solution at the same time. An SSO application allows employees to sign in and enter the MFA prompt just once to access all their applications. This saves time and makes MFA more convenient.

Support Employees With Training & Help

Ensure you train employees before the implementation of MFA to help them feel confident in the process. You should also provide help and support after they begin using MFA to address any questions and issues that might come up once your team begins using it.

Get Help Deploying MFA at Your Business to Improve Security

BrightSkye can assist your UK business with a successful implementation of MFA, along with other security services, to keep your network protected from threats.

Contact us today to schedule a consultation at 0141 212 2240 or reach out online.