Two-factor authentication, explained for a firm with no IT department

Two-factor authentication is the highest return security measure available to a small firm, and it is routinely put off for a year because it sounds like an IT project. It is not an IT project. For a firm of eight people it is an afternoon, most of which is spent waiting for people to install an app.

Worth understanding what it buys you, because that shapes how you roll it out.

What the second factor is actually for

Passwords fail in a specific way. An attacker does not usually guess yours. They obtain it, already correct, from somewhere else.

The mechanism is dull and extremely common. Somebody at your firm used the same password on a recipe site, a hotel booking, an old forum. One of those was breached, as thousands are every year, and the email address and password ended up in a list. Automated tools then try that pair against hundreds of other services, including every well-known business application. If it works anywhere, somebody logs in.

Notice that nothing about this involves your firm being targeted, or your systems being weak. The credential was correct. From the server’s point of view, that was a legitimate sign-in.

A second factor breaks the chain, because the stolen password is no longer sufficient. The attacker also needs the physical thing in your pocket. That is the entire idea, and it is why 2FA stops the overwhelming majority of real-world account compromises while a longer password policy stops almost none.

The kinds, ranked

Authenticator apps generate a six-digit code that changes every thirty seconds. Free, work offline, work on any phone, and they are the right default for a small firm. Any of the common ones will do, and they all follow the same open standard, so you are not locked into one.

Hardware keys are small USB or NFC devices. They are the strongest option because they also resist phishing, which the other methods do not. Worth the cost for partners, for anyone handling client funds, and for administrator accounts. Overkill as a firm-wide requirement, mostly because of the logistics of replacement.

SMS codes are the weakest form and still much better than nothing. The weakness is real, a SIM swap can redirect the code, but it requires a determined attacker doing work specifically against you, and it is not the threat most small firms face. Use SMS as a fallback for the person who genuinely cannot manage an app, not as the standard.

Email codes are the weakest of all, because the email account is usually the thing being protected. Avoid where you can.

Our own setup, including recovery codes and what to do about a lost device, is covered in two-factor authentication.

Rolling it out without a revolt

The rollout kills more 2FA projects than the technology. The pattern that works is unglamorous.

Start with yourself and one willing colleague. Live with it for a week. You will hit two or three small annoyances, and you want to have solved them before anyone else meets them, because the first complaint sets the tone for the whole firm.

Next, write down the recovery procedure before you enrol anybody else. Somebody will lose or replace a phone in the first month. Decide now who can reset their second factor, how that person confirms the caller is who they say, and where the recovery codes are kept. A firm that enrols everybody with no recovery plan will have its first lockout on a Friday and will disable 2FA by Monday.

Then enrol in small groups, with somebody available to help for ten minutes each. Do not do it by email broadcast. The whole enrolment is: install an app, scan a square, type six digits. It takes three minutes with a person beside you and forty-five minutes over email.

Finally, enforce it. Optional 2FA settles at about a third of staff, and the third that opts out is not a random third. Set the firm-wide requirement once the last person is enrolled; organization settings is where that switch lives.

The objections, answered honestly

“It will slow everyone down.” Marginally, and less than expected, because most systems only ask for the second factor on a new device or after a set period. The realistic cost is a few seconds a week per person.

“Our clients will hate it.” Your clients are already doing this at their bank. What they dislike is being asked to do something unexplained, not the mechanism. One sentence in the invitation handles it.

“We are too small to be a target.” This is the objection that matters and it rests on a misunderstanding. Nobody picked your firm. The attacks described above are untargeted and automated, and being small removes you from none of them. What being small does is remove your ability to absorb the aftermath.

“We have good passwords.” Password strength is irrelevant to the attack that actually happens, because the password was not guessed. It is worth having sensible rules anyway, and password requirements covers ours, but strength is not the control that stops this.

What to do about the accounts you forget

Two-factor on your document portal is good. Two-factor on your email is more important, because your email is how every other password gets reset. If you do one thing this week, do that one.

The full list worth covering at a small firm: email, document and practice management systems, cloud file storage, banking and payment systems, your domain registrar, and the password manager if you have one. That last one deserves a note. A password manager is the natural companion to 2FA, because the real fix for reused passwords is not willpower, it is not having to remember them.

Then handle departures. An account with 2FA still enrolled on a former employee’s personal phone is an access path nobody at the firm can see. Removing access on the last day, rather than the following quarter, is a two-minute task that firms consistently postpone; user roles and permissions covers what removing somebody actually involves.

One afternoon

Install an app, enrol yourself, write the recovery procedure, enrol the firm in pairs, switch on enforcement. That is the whole project, and it removes the largest single category of real breach at firms your size.

If you want help planning the rollout across the systems you actually use, get in touch.