Two-factor authentication as a security tool for business

Many businesses don’t use two-factor authentication to prevent other people accessing to their important data. Here’s why this needs to change.

Two-factor authentication, or 2FA, requires another form of identity when logging on, as well as entering your username and password. 2FA is an effective way to strengthen your security against entry into your systems.

Two-factor authentication adds an extra level of security when you log in.

Advantages of 2FA for business

  • It strengthens login security. 2FA helps overcome weaknesses in username and password logins. These include:
    • poor password practice (passwords that are understrength, overused or known by others)
    • difficulty in knowing when passwords are stolen, and
    • attacks that compromise user login details (like phishing or malware).

Even if an attacker gets access to staff passwords, 2FA adds another layer of security preventing access to your information.

  • It’s inexpensive. Many large cloud services providers offer 2FA for free. Once enabled, it requires very little training to get staff and / or customers up and running.

    Businesses can also use existing devices to enable 2FA. For example using an app like Google Authenticator, or using a SMS solution. Note: although it’s a lot better that not using it, there are flaws with a SMS or email solution. We recommend using a different option if it’s available.
  • It reduces data theft. 2FA is one of the best steps you can take to reduce unauthorised access to your systems. If someone gets into your system, it can result in:
    • data and intellectual property theft
    • disruption to your business
    • loss of customers, revenue, and credit rating
    • reputational damage with consumers, partners and the media.
  • Strengthens system security by protecting users. It is usually easier for attackers to target users rather than systems to gain access to your sensitive company information. Because of this, implementing 2FA for each user can protect the entire business network.
  • It can increase your flexibility. Adding 2FA makes using a VPN (virtual private network) safer. This allows staff to access work systems remotely, allowing them to work from home or on the go.
  • It can balance security with usability. You can prioritise which systems it's enabled on to cover your sensitive information. You can then continue to use single factor authentication for low risk or public information.

Implementing 2FA in your business

If you're not sure where to start, think about which systems you connect to via the internet. Those are the systems that attackers can more easily get access and credentials from. Because they are easier to target, those are the systems that are most important to protect. These are likely to be webmail, a VPN or any other cloud-based services.

If you're picking a 2FA solution for your product, good news! There is no shortage of 2FA solutions and services commercially available. Approaches and technology around 2FA can vary. Ask an information security expert about the best solution for your business.

Important factors to note when considering 2FA for your business

Two-factor authentication can’t be 'switched on' during or after an attack. Businesses need staff and customers to enable and use 2FA before an attack for it to be effective.

Although 2FA is a great security measure to use, it's not fool proof. You still need to use other good security practices to help keep your information safe.