Ninety percent of internet users are worried about having their passwords compromised, and they have a good reason. Password theft has risen to be the number one goal of phishing attacks and it’s responsible for a large percentage of cloud account data breaches.
Without proper cybersecurity protections in place, a hacker can wreak havoc if they compromise a user password. And one password breach often leads to more than one account being in jeopardy.
44% of people admit to reusing passwords across multiple work and personal accounts, so a breach of one account means all accounts using the password can also be accessed until it’s changed.
Unfortunately, we’re not usually aware right away when a password has been compromised. It can be months, for example, before you’d be aware that your password was involved in a major data breach. It takes time for the breach to be discovered and even more time for a notification plan to be carried out.
Even if you have strong security measures in place like encryption, if an attacker has a legitimate password, they can bypass safeguards designed to keep them out. Unless multi-factor authentication (MFA) has been put in place.
Using MFA with your logins can stop 99.9% of all fraudulent sign-in attempts. Even if a hacker has a password, it’s very unlikely they’ll also have the device that receives the code needed to gain account access.
Implementing MFA for all company logins is one of the best things you can do to boost IT security, and it’s important to understand the difference between the three main types of MFA.
3 Ways to Enable MFA Compared
When you enable multi-factor authentication, you’re setting up a system that sends a one-time, time-limited code to a specific device at login. Only after the user enters both the username/password combination and the code can they gain access to the account.
There are three different ways to receive the MFA code, and while all greatly improve security overall, there are some that are more secure than others.
We’ll go through each of the three types below and explain the key differences. For the security details, we referenced a Google study on multi-factor authentication that looked at the effectiveness of all three methods against three different types of cyberattacks.
Receiving the MFA Code by SMS
The least secure of the three methods is receiving the MFA code by SMS/text message. This is the most common method to use and is often the default method of website accounts and cloud tools when setting up MFA.
In the Google Study, SMS performed as follows:
- Blocked 76% of targeted attacks
- Blocked 96% of bulk phishing attacks
- Blocked 100% of automated bot attacks
One vulnerability that using SMS to receive the code has is that SIM cards can be cloned by hackers. One phishing text that a user clicks on can unleash malware that clones the SIM card and send the details back to the hacker. They can then see all the text messages sent to that phone.
On the plus side, SMS is one of the most convenient methods for users.
Receiving the MFA Code by Device Prompt
The next most popular method and one that holds the middle position for security is receiving the code through an app and on-device prompt. A popular app for MFA is Google Authenticator. This method is also commonly used on iPhones through a built-in feature when signing into iCloud.
In the Google study, here’s how the on-device prompt did:
- Blocked 90% of targeted attacks
- Blocked 99% of bulk phishing attacks
- Blocked 100% of automated bot attacks
This method is also fairly convenient for users, but it does take a little more setup if using a universal app, like Google Authenticator, because accounts have to be set up to use it.
Receiving the MFA Code by Security Key
The most secure method and the most expensive is using a security key to receive the MFA code. The other two methods are typically free, but you need to purchase a security key device from a vendor such as Yubico or Thetis.
Security keys are small, generally smaller than a USB flash drive, and are physically plugged into a computer or mobile device to authenticate the MFA code.
The additional cost pays off in a higher level of security. Here is how the security did in the Google study:
- Blocked 100% of targeted attacks
- Blocked 100% of bulk phishing attacks
- Blocked 100% of automated bot attacks
Besides having to purchase the keys, one downside is that users must carry around the key, and if it’s lost, they’ll need to jump through a few hoops to get a replacement and could be locked out of accounts until then.
How Secure Are Your Cloud Accounts?
Pro Tech Guy can help your Framingham business put an effective cybersecurity plan in place. We’ll help ensure passwords are protected with a system that balances convenience, cost, and security to meet your needs.
Contact us today to learn more. Call 508-364-8189 or reach us online.
