Two-factor authentication

What it means

Two-factor authentication asks for a second proof of identity alongside the password: a code from an app, a prompt on the phone, a hardware key. The password is something you know; the second factor is something you have.

The logic is simple. Even if the password leaks - through phishing, another service’s breach, or reuse - it is not enough on its own to get in.

Two passwords are not two factors. The second factor has to be of a different kind from the first - something you have, or something you are, such as a fingerprint. With single sign-on it is enough to switch on two-factor checks once on the central account, and it then protects every service signed into through it.

How it works in practice

Turn it on everywhere money can move or mail can be sent in the company’s name: online banking, e-mail, the accounting software, the payment gateway, domain management and cloud accounts. It is the cheapest measure in all of access control.

Code-generating apps and hardware keys are the strongest; an SMS code is weaker but still far better than a password alone. Backup codes are stored away from the device that does the verifying.

Where several people use one account, such as the webshop or internet banking, each should have their own login with their own second factor. We too work in clients' systems under our own accounts rather than a shared password, so when someone leaves, one access is revoked and everyone else carries on.

What to watch out for

The usual failure is not breaking the second factor but going around it: the attacker asks for the code by phone or e-mail in the name of the bank or IT support. Never read a code out to anyone - and the sign-in attempt will still be in the audit log as a trace.

When the second factor is tied to one employee’s private phone, the company loses access to its own accounts if that person leaves or loses the phone, and recovery through the provider’s support can take days or weeks. Company accounts should therefore have at least two factors registered, and the backup codes belong in the recovery plan.