You want to make network security one of your top priorities, especially these days when you can hardly go online without feeling like someone’s trying to take advantage of you. The password still plays a dominant role in network security, but the fact remains that it’s only one credential that hackers need to target you. Instead of depending on the password, more businesses are shifting to two-factor authentication, or 2FA.
Today, we’re examining how 2FA or multi-factor authentication (MFA) can keep your business and personal accounts safe and secure.
Basically, the gist of 2FA is that you need to verify your identity upon login by two credentials: a password (preferably a complex, unique one) and some secondary measure that usually falls into one of these categories:
For example, you might enter your password as usual, but then you’ll go to your phone to check for a secondary code or a security key. The goal here is to make it as difficult as possible for someone to break into an account with just the password.
Most users will enjoy a significant increase in security compared to if they were only using a password. It reduces the risk of unauthorized access and puts an end to brute-force attacks. It also protects you from the increasingly crafty phishing attacks that target businesses like yours each and every day. Data from Google and Microsoft strongly suggest that having 2FA has led to a dramatic reduction in successful account takeovers, so it’s time to start taking it seriously.
2FA might improve security, but certain complex attacks can still be carried out successfully. Here are some of the ways scammers and hackers are getting around 2FA and what you can do about it.
2FA can stop would-be phishing attacks, but more advanced MitM attacks can trick users into giving up both their password and their 2FA code using a fake website. The attacker then relays those credentials to the real site to gain access.
In this type of hack, the attacker might convince a mobile carrier into transferring your phone number to a SIM they control. This gives them the power to receive your 2FA codes. While it seems like a lot of effort, the attacker basically has unlimited freedom to unlock any of your 2FA-connected accounts.
Certain malware variants can steal your 2FA codes, or even control your device, all to get around the 2FA prompts.
A hacker might even try to use social engineering tactics, like convincing customer support to reset your 2FA or to grant them access to important information. Make sure you’re being careful with how (and where) you’re sharing information about yourself.
Perhaps the most obvious way hackers can get around 2FA is if they have your phone or hardware security key. They can easily bypass all of your 2FA if your device is unlocked or your key is unprotected.
Depending on the method, you might see varying results from 2FA providers:
2FA is way more secure than your standard password, so you’ll want to use it on most, if not all, of your accounts if you can. We recommend you enable it wherever possible, but if you can’t, make sure you’re still remaining cautious about phishing attacks. Furthermore, be sure to double-check URLs, be wary of suspicious requests, and keep your devices secured. For any and all of your 2FA and network security needs, reach out to First Column IT at (571) 470-5594.
