It seems like every day, we’re reading about another security breach or cyberthreat. While attacks on large corporations may get the headlines, the number of cyberattacks aimed at small and medium-sized businesses is alarming.
According to a study by Accenture, 43% of cyberattacks are aimed at smaller businesses, and just 14% are prepared to defend themselves. The impact can be devastating. It costs the average company more than $200,000 to recover, and 60% close their doors permanently within six months of an attack.
While the type of cyberattacks and security breaches targeting small and medium-sized businesses vary, most of them begin with weak or stolen passwords. An easy way to mitigate your risk is to require strong passwords and deploy two-factor authentication (2FA).
What Is Two Factor Authentication (2FA)?
Two-factor authentication (2FA) requires an additional step when users sign on to their accounts or access company networks. The additional step strengthens security by forcing users to verify their identity beyond just entering their username and password.
When logging in with 2FA enabled, systems can automatically generate a random code that is sent to a user’s smartphone. They will be unable to log in until they then enter the code. Different 2FA systems allow codes to be sent via text (SMS), email, phone call, app, or hardware token.
There are also apps that can be used for 2FA. For example, users download a security app that generates random codes that are only usable for a brief period. Other apps simply require an acknowledgment from the user that they are trying to log in.
Besides codes, users may be asked instead to answer a security question or use fingerprint, facial recognition, or voice recognition to verify their identity. For even greater security, some companies use hardware tokens.
Hardware tokens are fobs you can put on a keychain that produce random codes every 30 seconds or so. When users log in, they need to check with the device and enter the code shown on the token. Unless a hacker has login credentials and the hardware token for an employee, they will not gain access to your network. Even if the hacker somehow captures the random code, it won’t be of any use since it changes constantly.
2FA is an effective way to protect against many security threats and prevent unauthorized access. Even if a hacker has stolen someone’s username and password, 2FA prevents them from logging in unless the cybercriminal also has physical possession of someone’s cell phone or token.
Why Is Two Factor Authentication (2FA) Important?
People are notoriously lax with passwords. They use weak passwords that are easy to guess and tend to use many of them repeatedly. An analysis of 15 billion passwords showed that less than 15% were unique.
Shockingly, people are still using basic passwords. Here are the top 10 in use today:
People also have many online accounts, so they tend to use passwords that are easy to remember. Unfortunately, that also makes passwords easy for hackers to guess. Children’s birthdays, pet names, and favorite teams are also common and relatively easy to figure out by checking someone’s social media account.
Tools to crack passwords are readily accessible online. Of the top 20 most commonly used passwords, it took these online tools less than one second to find the password for 16 of them. Only one of the top 50 most used passwords took a day to crack.
People also tend to reuse passwords from site to site. So, once a hacker gains access to one account, they can likely access several more. So, even if hackers don’t have access to your site, once they grab someone’s password from somewhere else, they may be able to get into your system.
There are also marketplaces on the dark web where passwords are aggregated, bought, and sold.
While hacking someone’s password is easy, stealing someone’s password and cell phone is a lot harder. So, adding 2FA is a simple way to decrease the odds of hackers getting into your systems.
If your business is looking for reliable protection from security breaches or a comprehensive, proactive Managed IT solution, talk to the experts at HIG today.