We spend a lot of time thinking about cybersecurity risks. Most of that time is spent analyzing the latest attack methods and how we can help businesses in Ohio stay safe through better security training and technical protection.

The good news is that with just a few simple steps like password management and multifactor authentication (MFA), small, and midsized businesses in our state could dramatically improve the state of their security and avoid intrusion, without a huge expense of hassle.

This short guide is designed to provide our community with everything they need to understand the benefits of MFA and how to implement it across your company with ease.

What Is Multi-Factor Authentication?

MFA is a method of access control that requires users to provide multiple pieces of evidence, also known as “factors,” to verify their identities and gain access to their systems. For example, in addition to using a simple password, a system protected by MFA will ask you to provide further evidence to prove that you’re authorized to access it.

Typically, this second factor comes from one of three categories:

Knowledge Factor – This is often deep personal information, such as the name of a beloved pet or childhood experience.
Possession factor – This most commonly refers to a cell phone, tablet, or hardware dongle that is connected to the secure system.
Inherence factor – This group includes something that you are, usually a fingerprint or retinal scan.

Why MFA is Critical to Small Business Security

Passwords are a chronic source of cybersecurity vulnerability for businesses. Staff who use weak passwords leave systems open to being compromised by automated password cracking techniques, while phishing attacks that trick them into handing over access continue to be a serious problem.

By requiring people to use more than just a simple password, MFA dramatically reduces the number of password-based attacks that have been rising so steeply in recent years.

According to Microsoft, deploying MFA can reduce the number of authentication-based incidents in a business by up to 99%.

MFA Adoption at SMBs Remains Low
Despite the obvious benefits, over two-thirds of smaller organizations have not implemented MFA yet. Why? Here are the most common obstacles that we’ve noticed in our dialog with local businesses.

• Fears of Efficiency Loss
  A longer log-in process for systems can slow down an employee’s workday. If your team doesn’t have their second factor handy, or something is wrong with it, then it could really hurt their productivity.
• Lack of Technical Staff
  Maximizing the return on your MFA investment will mean analyzing your overall network and security posture, choosing the best MFA solution for each system, then configuring the solution to close any security loopholes. This process can be daunting for non-technical companies.
• Integration Fears
  Companies with legacy hardware or software solutions (sometimes rightly) worry that MFA solutions might affect their old systems or cause technical problems. Even those with in-house IT staff may stay away, not wanting to begin down a long and costly road.
  

Choosing the Right Multifactor Authentication

Many people are familiar with MFA even if they’ve never heard the term before. One of the most common examples of MFA is when you enter your password on a system or device, after which it sends a code to your mobile phone for confirmation. This arrangement, known as a time-based, one-time password, is typical at banks and financial institutions.

But that’s just one form of MFA; there are many other types of multifactor authentication, each of which has a specific use case.

• App-based
  Some MFA providers like LastPass and Duo use an app built on proprietary protocols. The benefit of this approach is a smoother authentication process with no numbers or codes to enter. However, like any device-level form of authentication, if the user becomes separated from their device and can’t receive the notification, it can lock them out of the system.
• Biometrics
  Gaining in popularity, biometric authentication relies on some feature of your body that uniquely identifies you, such as a picture of your face, retina, or fingerprint. The downside of biometrics is that they’re more expensive to implement than other systems, and that staff may be uncomfortable with their invasive nature.

Which factors you decide to use will depend on the situation in your company. We recommend that before you deploy an MFA system in your business, you start with a thorough analysis of your network. Here are some of the elements that will determine the details of your MFA deployment:

• Compliance Requirements
  Organizations dealing with regulatory compliance requirements, like those in healthcare and finance, must be more aggressive with an MFA deployment than those who aren’t handling sensitive personally identifiable information (PII).
• Employee Habits and Culture
  If you have lots of remote employees working from laptops, then naturally you’ll want to ensure that the maximum level of protection goes to those devices, because device theft and loss is still a major source of security problems. Companies with mostly on-premise staff will probably want to start by deploying MFA on servers and workstations and then expand outward based on their needs.

MFA Doesn’t Mean Worry-Free Cybersecurity

While MFA will stop most password-based attacks, it doesn’t mean you can just stop worrying about cybersecurity, unfortunately.

Some forms of MFA are still vulnerable to phishing attacks, so-called “push bomb” attacks, protocol vulnerabilities, or SIM-based hardware attacks. Just a few months ago, we wrote an article about MFA attacks and how hackers managed to bypass MFA by spoofing cell phone authentication notifications.

To maximize the impact of your MFA implementation, here are some of the steps you should be taking to ensure that it provides the security you need:

• Educate Users
  It’s critical that you have buy-in from your employees how important MFA is to your business’s security. Attempts to bypass MFA or employee fatigue with the second factor should both be taken seriously.
• Maintain the System
  Like any security solution, you’ll need to perform ongoing maintenance to ensure that that it’s providing the correct level of protection. This includes regular scanning of the cybersecurity news to see how hackers are hacking MFA systems and if your service has been affected, and making sure that your configuration aligns with your network protections.

Ohio’s MFA and Cybersecurity Services Partner

If you’re interested in deploying MFA in your network, you shouldn’t go it alone. The Astute Technology Management team helps businesses in Columbus and Cincinnati clarify their security needs, identify the right MFA solution, and configure that solution so it protects their entire network, with no guesswork or stress.

Contact us any time at 614 389 4102 or [email protected]. We look forward to speaking with you!