A second check at login is cheap, and the recovery path is where it goes wrong.
The password of somebody who left last year still works. It is on a slip in a drawer, or in a WhatsApp message from the day they joined. Nobody noticed, because nothing looked any different.
A second factor makes that password useless on its own. It also makes a locked-out branch manager your problem at eight in the morning, so both halves have to be built.
Multi-factor authentication asks for something beyond the password: a code from an app, a one-time password by SMS, an approval tapped on a phone, or a hardware key. The point is that a stolen password stops being enough, because whoever has it also needs the thing in the person’s hand.
Where it earns its place.
Where the second factor is worth the friction
- Accounts that can change bank details, payouts or prices
- Anybody who can export the customer list
- Admin and super admin logins, without exception
- Remote access to servers and databases
- Approving a transaction above whatever limit your business sets
The methods, and what each one costs you
There is no perfect method. There is the one your people will actually use, and it is usually not the strongest one available.
- SMS one-time password: familiar to everyone here, and the weakest, since a SIM can be swapped and a network can be slow
- Authenticator app: stronger, nothing to pay per message, and needs explaining once
- Push approval: easy to tap, and easy to tap without reading
- Hardware key: the strongest, and sensible for a small set of admin accounts
- Email code: better than nothing, and only as strong as that mailbox
Most businesses we work with settle on an authenticator app for staff, with SMS as the fallback. That compromise is made deliberately, not by accident.
The recovery path is the actual project
People change phones, lose phones, and factory-reset them before selling. Plan for that day, because it arrives in the first month.
- Recovery codes shown once at setup, with somewhere people are told to keep them
- A named person who can reset a factor, and a record of every reset
- An identity check before that reset, or you have built a fresh way in
- A plan for the accounts that must never be locked out, starting with the owner’s
How we add it to a system you already run
- Audit logins
- Pick methods
- Admins first
- Staff
- Recovery
- Enforce
- Listing who can do what, which usually turns up accounts nobody remembers creating
- Turning it on for admins before anybody else is asked
- A period where staff can enrol before it becomes compulsory
- Remembering a trusted device, so the same laptop is not challenged every morning
Fix the shared login first
On a good number of the systems we are asked to secure, the missing second factor is not the real hole.
- One login the whole counter uses, so no action has a name against it
- The account of somebody who left, still active
- A password shared on WhatsApp because one person is on leave
- Admin rights given to everybody, because that was quicker at the time
Put a second factor on a shared account and it proves somebody in the room had the phone. That was never the question you needed answered.
When this is the right choice.
- Software holding customer data, money movement, or anything with a compliance obligation behind it
- Staff signing in from home, from a branch, or from their own phones
- An admin panel reachable from the open internet
- A business that has had an account misused, or very nearly
When it is not.
- Every account regardless of what it can reach, which teaches people to work around it
- A shared shop-floor terminal used by a whole shift, where device restrictions fit better
- A system where several people share one login, until each of them has their own
- A roll-out with no way to reset a lost factor, which will strand somebody in the first week
- Standing in for the basics: leavers removed, admin rights trimmed, passwords not reused
Questions we are asked about it.
Will our staff put up with it?
Mostly, if they are asked rarely. A trusted device is remembered for a period, so somebody on the same laptop each morning is not challenged daily. Friction at every login is what makes people start sharing codes.
Is SMS one-time password good enough?
Better than a password alone, weaker than an app. SIM swap is a real attack and operator delivery is not always quick. For admin accounts we push for an authenticator app and keep SMS as the backup.
Can we use Google or Microsoft sign-in instead?
Often the neatest answer, if your team already has those accounts with the second factor switched on. The identity provider handles it and your application trusts the result. That is less to maintain than another login of your own.
What about customers rather than staff?
For customers, an OTP on a mobile number is usually the whole authentication rather than a second step. Adding more to a customer login costs you orders. Keep the strict rules for accounts that can do damage.
How long does it take to add?
Putting the check into an existing login is rarely the large part. The time goes into recovery, the roll-out and the support plan. A rushed roll-out creates more trouble than the risk it removed.
Can you tell us how bad our access situation is now?
Yes. The free technology audit covers who can sign in, what they can reach, and which accounts belong to people who have left. Most of what comes back is removals rather than anything new to build.
Services that use it.
What it sits with.
Not sure Multi-factor authentication is the right choice?
Tell us what the software has to do and who opens it. If something else fits better, we will say so, and say why.
- No obligation
- We reply the same working day
- Your details stay private