Let’s be honest. Remembering passwords on top of the million other things to do in any given day is a lot. Are your team’s passwords fairly similar across multiple online accounts? It’s okay, you are not the only business.
Most people reuse their passwords over many different applications, and have one or two passwords only. With the increased need for security, however, there are now much better ways to protect your accounts and provide additional layers of security.
Nowadays almost all online services, banks, social media, shopping have added a way for your accounts to be more secure.
Here we help you to understand MFA and 2FA plus introduce you to LastPass to manage your passwords.
Maybe you’ve heard of the term MFA or 2FA and are slightly confused. Let us help you break what this is and why you need it.
MFA = Multifactor authentication
2FA = Two factor authentication
In the old days!
In the old way of doing things you signed in to your online accounts in a process called ‘authentication’. That included a basic login and password. For example
Multifactor Authentication (MFA), however, works by adding additional layers of security to your online accounts.
This provides a “second” thing – what we call a second “factor” – to prove who you are.
Yes, the first layer remains as your username and password, however now you can add another layer of protection. For example:
What this additional level of protection does is helps to ensure that you are who you say you are when logging into your online account.
So even if someone gets your user name and password, and logs in with your credentials, they will be stopped!
You will get an immediate notification on your phone to indicate that someone is trying to login to your account.
You can then decline the authorisation, locking them out. This also tells you that your password has been guessed, so you know to change your password.
Many of your current apps will have an MFA feature that you can turn on. For other things like email, you can enable MFA.
This may mean talking to your ITA provider so that we can assist you to help turn on your Microsoft 365 MFA feature.
Once it is turned on, you and your team will need to use MFA before you can next access you emails/Teams and other applications.
Make sure that everyone is ready for this and knows what to do. It isn’t hard, but like with all changes, its best to ensure that you have support from the rollout.
Reusing the same passwords across multiple accounts is not a safe idea as it creates an opportunity for credential stuffing attacks. A credential stuffing attack is one where leaked credentials from one site/service are used on another site/service to see if they work. It would be like using the same key for your car and your house.
For example, if you use the same password on your online bank account and Facebook, an attacker can easily breach both of your accounts even though you may not have reused the same password on your email account. This potential harm this practice can cause may be a monetary loss, data loss or loss of sensitive personal details.
Here at the ITA we recommend that you update your password after every three months, unless you have been the victim of a cyber-attack, then you should change your password immediately. This ensures that if your credentials are breached, then they are not able to immediately breach other accounts also.
Password strength is a big topic of discussion. You know the drill, you must use lower and uppercase letters, use numbers, use special characters, make sure it is long. But even after all this effort, your password can still be weak!
You can test your passwords out before you use them at https://www.passwordmonster.com/ or https://password.kaspersky.com/. This information gives you feedback about the strength of your password, which should help you to strengthen your password choices:
(Note: Your password is not collected or stored at either of these websites. They are well known secure sources of information that you can trust)
Yes, it is definitely best practice to use a Password Manager.
Password Managers allows you to keep track of your passwords without having to remember them.
LastPass is a free or paid personal password manager for an individual, however, if you want to protect your business, you need LastPass Business. We can help you specifically with this.
Having MFA or 2FA is an essential these days, and so is having decent and unique passwords. For practical reasons you need to have a business password solution in place to ensure your team are password secure.
Here at the IT Centre, we can help you to simplify this process, and provide you with support to easily and effortlessly apply these tips. If you would like to discuss your specific needs, please feel free to reach out to us here.