Multifactor authentication (MFA) is an increasingly common defence between IT systems and cybercriminals. In the modern era of growing cybersecurity threats and dependence upon IT systems it is essential to authenticate the identity of a user with more than just a password. Due to the fact they can be complex, there are many misconceptions around MFA, and there is no one-size-fits-all solution. Without thoughtful and personalised implementation, MFA could harm your business in surprising ways, from reduced productivity to providing a false sense of security. Done right, MFA could be your most powerful shield against cyber criminals.
You have almost certainly experienced the frustration of forgetting a password, but now consider that with multiple authentication steps, you are likely to experience this inconvenience at least twice as often, eating into your productivity. As most factors rely on digital devices to authenticate the user, employees may lose access to their accounts due to a misplaced or faulty device – this can take days to fix. If a member of staff cannot be authenticated they cannot log into their account and therefore they cannot work. Worse, a lost device could jeopardise security altogether. These scenarios are particularly common nowadays, with more work carried out on personal devices, staff accessing company accounts from home or other locations, and with third-party workers who require access. The resulting frustration may lead to carelessness, such as recovery keys being stored in places where they are easily revealed, thereby compromising the whole system.
The solution to these problems lies in collaboration with your vendor. During the set-up process, your MFA vendor should provide awareness training to ensure your users understand how MFA works and why it is important. When it has been set-up properly, MFA should not cause any frustration and require only a tiny amount of your user’s time. As the security of your business is an on-going concern, you should continue to collaborate with your vendor so that problems can be recognised and resolved.
On-going collaboration is important not only for the scenarios outlined above, but because new cyber threats emerge daily. It is important for you to know when new vulnerabilities create holes in your system so that you can reassess your risk and modernize your authentication methods. MFA should be implemented with the awareness that cybersecurity threats are constantly being discovered and something considered secure today might be of little value in the future. For example, authentication via SMS (text message) has been proven to be vulnerable to a variety of threats including interception and phone cloning. In spite of this, many users are not warned of this and SMS is still one of the most popular authentication factors: it is sold on the basis of convenience rather than security. As a result, many MFA users possess a false sense of security due to poor communication from their vendor. Peace of mind is easy to sell, but real security cannot be guaranteed without collaboration. You should work with a vendor who is willing to explain the vulnerabilities as well as the strengths of the product they are selling to you.
Without proper consultation, businesses are often sold MFA solutions that do not meet their needs in either convenience or security. To avoid this issue, it is best that all MFA options are explored and considered from the start. It is important that you work with a vendor who has specialist experience in MFA and can deploy MFA in a variety of formats. A vendor who cannot deploy MFA in the cloud, on-premises, as SaaS or a hybrid of these may not be able to provide you with the best deployment option to suit your needs – nor or be in a position of impartiality to advise you on the best option. After all, a salesman who only sells sports cars is unlikely to recommend the family car you really need.
Authentication can be done using a variety of factors, each having its own range of advantages and disadvantages that must be considered in the context of your business risk profile and background. Check with your IT vendor if they provide all these factors and deployment capabilities before taking their advice. If they do not, you should consult another vendor to ensure you receive the most relevant advice.
In conclusion, your vendor is key to your research, implementation and maintenance of multifactor authentication. Sacrificing security for convenience is the gravest mistake – by going straight to your regular IT vendor without reviewing other options you may be guilty of this.
Speak with us today to learn about our MFA capabilities and what we can provide for your business.