A Stolen Password Should Not Be Enough to Take Your Business
Two-factor authentication is the single highest-value security change a small business can make, and it takes ten minutes per account.
Two-factor authentication is the highest-value security change a small business can make. It takes about ten minutes per account.
Without it, one password is the only thing between an attacker and your email, your bank, and your domain. Passwords leak constantly, through breaches you will never hear about.
What it does
After the password, the account asks for a second proof. That is a code from an app, a tap on your phone, a fingerprint, or a physical key.
An attacker with your password now has half of what they need. They are on the wrong side of the world, with no way to get the other half.
Not all second factors are equal
Ranked from strongest to weakest:
- A hardware key. A physical device you plug in or tap. Strongest available, and phishing cannot defeat it.
- An authenticator app. A rotating six-digit code on your phone. Strong, free, and the right default for most businesses.
- A text message. Better than nothing. Attackers can hijack a phone number, so avoid it on your email and your bank.
Use an app. Use a key on the accounts that would end the business.
Protect these four accounts first
- Your email. Every other password can be reset through it. This is the master key.
- Your domain registrar. Losing it means losing your website and your email address at the same time.
- Your banking and payment accounts.
- Your website and hosting admin.
Everything else can wait a week. These four cannot.
What it costs you in practice
One extra tap on a new device. Most services stop asking on machines you use daily.
Weigh that against explaining to your customers that their information left through your inbox.
Set up recovery before you need it
Save the backup codes each service gives you. Put them somewhere you can reach without your phone. Register a second device if the service allows it.
The one real risk with two-factor is locking yourself out. Ten minutes of preparation removes it.
If you want this set up across your business accounts properly, email jon@delcaromedia.com.