Cyber crime is an ongoing threat for organizations, with incidents such as ransomware attacks, fraudulent sign-in attempts and breaches due to stolen credentials continuing to rise. And no organization is safe – cyber criminals target businesses large and small. According to the Federal Bureau of Investigation, there has been a 69% increase in internet crime in 2020, with reported losses exceeding $4.1 billion.1
Now more than ever, organizations need to take all necessary precautions to secure their systems and data. Passwords alone are not enough. Multifactor authentication (MFA) can help stop cyber attacks in their tracks, blocking 99.9% of account-compromising attacks.2
What Is MFA?
MFA is a security method that requires the use of two or more authentication factors to verify a user’s identity. MFA is often used to verify users who are accessing an organization’s network or their email remotely, or accessing privileged or administrative accounts. MFA provides greater assurance that users are who they say they are and helps keep data and business systems safe even if one set of credentials (such as a user ID and password) has been compromised.
How Does MFA Work?
To verify a user’s identity prior to granting access, MFA uses authentication factors that fall into at least two of three categories:
- Knowledge – Something only the user knows, such as a password, PIN or answers to personal security questions.
- Possession – Something only the user has, such as their smartphone, a smart card or a software token.
- Biometric – Something that is unique to the user, such as a fingerprint or retinal scan.
For example, when logging in to an organization’s network, the first authentication factor may be the user’s standard username and password credentials. The second factor may include a one-time passcode sent to the user’s smartphone, which can only be accessed by using a third factor, such as a matching fingerprint.
As a general rule, the more authentication factors required, the more robust the security. MFA also requires that these authentication factors be independent of one another. If one factor grants access to another factor, the integrity of the structure could be compromised.
Why Should You Use MFA in Your Business?
The average cost of a data breach was $3.86 million in 2020,3 which is a concerning factor for organizations of all sizes. MFA can be a strong component of an organization’s security strategy for many reasons:
- Limits digital credential theft. MFA makes it more difficult for criminals to steal digital credentials and limits the usefulness of the stolen credentials. Even if a hacker gains access to your employees’ usernames and passwords, they’re unlikely to have access to the additional factors required to log in, such as the user’s fingerprint or the smartphone to which a one-time passcode has been sent.
- Strengthens existing systems. Other cybersecurity solutions, such as firewalls and anti-virus protection, are only as strong as the authentication steps that protect them. MFA helps make existing security systems stronger.
- Protects high-value targets. Administrative and executive accounts are high-value targets for hackers seeking to gain broader access to a network – and the sensitive business information contained therein. MFA can be used specifically to protect these accounts.
- Deters cyber exploits. Cyber crime involves more than stealing information. With MFA, you can also deter hackers from destroying data, deploying ransomware, changing programs and transmitting spam or malicious code throughout an organization’s systems.
- Secures email access. Intruders often use email access to carry out cyber schemes against businesses, their clients and customers. MFA can help minimize the risk of criminals gaining remote access to a user’s corporate email account.
How Can Your Business Get Started with MFA?
An organization should be clear about what they want to protect and know that there is flexibility regarding which authentication factors can be used without unduly inconveniencing their users.
An extra layer of security in the form of MFA is crucial, but the options can vary from one solution to the next. To learn how a business can implement MFA and increase their cyber defenses, Travelers offers its CyberRisk policyholders access to a one-hour consultation with a Symantec™ Security Coach, who can provide much-needed expertise and help pave the way for a stronger cybersecurity program.
Travelers can help you build a strong security program with flexible insurance options and policyholder benefits that includes pre-breach services and access to other cybersecurity resources.
Sources:
1https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf
2https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks
3https://www.ibm.com/security/data-breach