If a stranger learns your email password, what stops them from signing in? For most small businesses, the honest answer is: nothing. Multi-factor authentication (MFA) is what stops them. After the password, the sign-in asks for a second proof, such as a code or an approval on your phone, that a stranger can’t supply.
MFA is one of the cheapest and most effective security steps a business can take. It is also one of the most commonly skipped.
How MFA works
You sign in with something you know (your password) and something you have (your phone or a security key). A stolen or guessed password isn’t enough on its own, so the attack stops at the second step.
Which method to use
- Authenticator app. An app on your phone shows a code or asks you to approve the sign-in. Good for most people and free.
- Security key. A small physical key you plug in or tap. The strongest option, best for administrators and owners.
- Text message codes. Better than nothing, weaker than the options above because phone numbers can be hijacked. Use them only if nothing else works for a person.
Where to turn it on first
- Administrator accounts. Anyone who can change settings, add users or reach billing.
- Email. Microsoft 365 and Google Workspace. Email resets every other password, so protecting it protects everything.
- Banking, payroll and accounting.
- Remote access. VPNs and anything that lets someone reach your network from outside.
- Everyone else. Once the first four are covered, turn it on for every user.
How to roll it out without a revolt
- Tell people why. One short email explaining that this protects their accounts and the business.
- Pick one method and teach it. A 10-minute walkthrough beats a ten-page document.
- Set it up with them. Most people only need help once, on their phone.
- Plan for lost phones. Decide in advance how someone gets back in if their phone is lost or replaced.
- Keep admin accounts separate. The account you read email with shouldn’t be the one with administrator rights.
What MFA doesn’t stop
MFA is strong, but it isn’t magic. Attackers sometimes trick people into approving a prompt they didn’t start, or steal a sign-in after it has been approved. Treat an unexpected approval request as a warning sign, and deny it. Pair MFA with email security and staff training for layered protection. Our guides to Microsoft 365 and Google Workspace show where to enforce it, and the free Email Security Checker shows whether scammers can send email as your business.
What it costs
For Microsoft 365 and Google Workspace, MFA is included. The cost is a little time up front and a few seconds per sign-in. Compared with the cost of a hijacked email account, it’s one of the best bargains in IT.
A quick check
- Is MFA required for every account, including admins and shared accounts?
- Do administrators use separate accounts for admin work?
- Do you know what happens when someone loses a phone?
If you can’t answer yes to all three, that’s your starting point. MFA is one layer of our cybersecurity services.
Want MFA rolled out across your team without the headaches? Start with a free discovery call. We’ll talk through your accounts, then quote the rollout in writing.
Leave a Reply