Most successful attacks don’t start with sophisticated technology but with a stolen password. It comes from a data leak, was phished or simply guessed. Multi-factor authentication (MFA) makes exactly these passwords worthless.
How MFA works
When logging in, a second proof is required in addition to the password:
- a code from an authenticator app on your smartphone,
- a push notification you confirm,
- or a security key (FIDO2) connected via USB or NFC.
An attacker with your password gets no further. According to Microsoft, MFA prevents the vast majority of automated account takeovers.
Where MFA should be mandatory
- Email accounts – whoever takes over your mailbox can reset passwords and send invoices in your name.
- Remote access to the company network (VPN, terminal server).
- Administrator accounts for servers, firewalls and cloud services.
- Accounting and online banking.
Typical pitfalls – and how to avoid them
- “It’s too complicated.” With push confirmation, logging in takes a few seconds. A short training session removes the fear.
- Lost phone. Store recovery codes safely in advance and register a second factor.
- Fatigue attacks. Attackers send push requests until someone confirms out of annoyance. Number matching and clear rules help: never approve a login you did not start yourself.
Rollout in three steps
- List all accounts and access points that need protection.
- Start with administrators and management – that is where the risk is highest.
- Switch the whole team over with a short guide and stay available for questions.
Conclusion
MFA costs little and achieves a lot. If you implement only one security measure this year, make it this one. We help with the setup – for remote work access, email and servers.
Frequently asked questions
Is SMS secure enough as a second factor?
SMS is better than nothing, but vulnerable to redirection. Authenticator apps or security keys are significantly more secure.
Does every employee need a company phone?
No. The authenticator app also runs on private smartphones. Alternatively, security keys are available for a few francs.
What does introducing MFA cost?
MFA is already included in Microsoft 365 and many other services. The costs are mainly for setup and training.
