Hi! Eric Murcia here with another episode of Tech Tip Tuesday. This week, we’re going to be talking about a little something called “Multi-Factor Authentication” or sometimes “Dual-Factor Authentication”.
What is Multi-Factor Authentication?
Chances are, most of you are already familiar with this, whether you know it or not. If you do any kind of online banking or anything like that, you’ve probably seen this. It’s the whole idea of when a user logs into a system, whether it’s a computer or email or anything for that matter, that the user presents both a password and some other form of authentication or identification. That [process] being where the name Multi-Factor or Dual-Factor Authentication comes from.
Microsoft Office 365 Multi-Factor Authentication
In this example, I’m going to show you how Office 365 works. Most of our clients use that. Most businesses I come across are using that today or some form of that system. So, I’m just going to access the portal here. You will see that, once I give it my password, it’s also going to send an approval request to, in my case, devices I have set up to authenticate. You can’t see this, but I just got the approval request on my watch, I’m now telling it to approve that login, and it will let me into the portal.
Why Does Multi-Factor Authentication Matter?
Now, why is that important? Well, it’s very important from a security perspective, in that, that is the most secure way to operate this account. Even if I get one of those [phishing] emails that’s going around the internet, and I type my password in, and now a bad guy has my password, he still can’t access my account, because he doesn’t have the app on my phone that generates the key, which is unique to me. It randomly generates it every 20 or 30 seconds. How I’ve set mine up is it will send a message to the app. If I don’t answer there, it will send a text message. You can even set it up to call you. Different apps have different options built-in.
MFA is Highly Recommended
From a security standpoint, this is the most secure way to operate anything that you log into. When it comes to things like Office 365 and Gmail, I highly recommend that anyone who has an administrative-level account has this, at a minimum, enabled for themselves, if not enabled for their other staff or all their staff.
I’ve seen instances where someone will impersonate someone else after gaining access to their email in such a way to get a check cut to a phony vendor, or something like that. We do so much communication and email, which is why I chose to use that as an example. It’s very important that we safeguard that as well as we can. A lot of damage can come to the reputation of a business just from someone getting compromised.
Is This Foolproof?
So with that being said, questions that come up frequently are, “Is this foolproof?” Unfortunately, no, there’s no foolproof form of security out there, but this is pretty good. If you have two companies with all things being equal, but one has this implemented across the board, and the other does not, chances are, the one that does not is going to become compromised long before the one that took the time to implement these things.
How Does This Change The User Experience?
The other question I get is, “How does this change the user experience?” Well, depending on what you’re doing, if we’re talking about Office 365, it can make things a little more cumbersome for users to log into. It’s a trade-off of convenience for security. At the end of the day, that’s a business decision that every company has to make and weigh the pros and cons of that. That is your Tech Tip for this week, I look forward to talking to you again next week.
Looking for More Tips?
We have new episodes of Tech Tip Tuesday every Tuesday (you guessed it). You can view previous episodes in our Tech Tip Tuesday library. Blog posts with various IT tips and news are released every Friday. Click the Sign Up or Subscribe button on this page to subscribe and receive every tip directly in your inbox each week. Pit Crew IT Services can also help your organization with any IT needs you might have. Get started with a free consultation using the button below.