This multi-factor authentication guide for small firms says: turn on a second check for email first, then for every tool that holds money, customer data or admin rights. A stolen password alone then stops working. This note explains what MFA is, which methods are strongest and how to roll it out to a team without a long project.
What multi-factor authentication does
MFA asks for more than one kind of proof before a login works. The first proof is usually something you know, such as a password. The second is usually something you have, such as a one-time code from a token or an app. Some tools also accept something you are, such as a fingerprint.
The point is simple. Passwords leak, get guessed and get reused. If a thief has your password but not your phone or key, the thief is still locked out.
Singapore's cybersecurity agency says the same in a June 2022 advisory. It tells people to enable MFA or two-factor authentication on their online accounts whenever possible. Two-factor is the most common form of MFA, with exactly two proofs.
Start with the accounts that matter most
You do not need to switch on everything in one day. Rank your accounts by the damage a break-in would cause, and start at the top.
Put these first: the email account of each owner and manager, the bank and payment tools, the accounting software, the cloud storage that holds client files, and any admin console that controls other accounts. Email comes first because it can reset the password for almost everything else.
Then move to social media pages, the website editor and the domain name account. A hijacked company page or a lost domain can hurt a small firm for weeks.
Most business tools list MFA under security or account settings. Look for words such as two-step verification, two-factor or authenticator.
Which methods are strongest
Not all second factors are equal. Here is a plain ranking, from stronger to weaker.
Hardware security keys. A small device you plug in or tap. NIST, the United States standards body, describes cryptographic devices that hold a secret key which cannot be copied out. The secret stays inside the device, which makes it hard for a thief to copy. NIST recommends a physical action, such as a button press, as part of the check.
Authenticator apps. An app on a phone shows a one-time code. NIST says time-based codes must change at least every two minutes and work only once. Codes typed in by hand can still be handed to a fake site, so never type one into a page you reached from a message.
Text message codes. Better than a password alone, but the weakest of the three. NIST labels the phone network as a restricted channel for sending codes. It asks sites to check that the number is tied to a real device, and it suggests they weigh risk signs such as a SIM change or a number port. Use text codes only when nothing stronger is on offer.
A good rule: choose the strongest method each tool allows, and keep a text code as the fallback.
How to roll it out to staff
Set a date and tell people why. A short message works: a stolen password should not be enough to enter our accounts.
Run the rollout in three steps. First, owners and managers switch it on and test it. Second, each team joins in small groups, with ten minutes of help at a desk or on a call. Third, check each tool's admin page and confirm every user is enrolled. Some tools let an administrator make MFA required for everyone, and that is better than asking.
Give staff two simple rules. Never share a code with anyone, including a caller who says they work for the bank or the vendor. And if a login prompt appears that you did not start, say no and tell the office manager.
Singapore's agency also warns about phishing. Fake emails can pose as a bank or a delivery firm and lead to fake password reset or login pages, so never enter a password or code on a page you reached from a message.
Plan for lost phones and departures
Things go wrong. A phone breaks, or a worker leaves. Plan for both before they happen.
Save the backup codes that most tools give you when you enrol. Print them or store them in a locked place, not in the same inbox they protect. Add a second method where the tool allows it, such as a spare security key kept in a safe.
When someone leaves, remove their access on the day, then remove their enrolled devices from each admin console. Keep a short list of who holds admin rights, and review it every few months.
Last, keep your passwords strong too. MFA adds a layer, and it does not replace one. Use a long phrase of several unrelated words, use a different one for every account, and change it at once if you think it was exposed.
Sources
- NIST Special Publication 800-63B: https://pages.nist.gov/800-63-3/sp800-63b.html
- Cyber Security Agency of Singapore, Advisory AD-2022-008, 24 June 2022: https://www.csa.gov.sg/alerts-advisories/Advisories/2022/ad-2022-008/