If you could apply only one security measure this year, it would be this one: two-factor authentication.
How it works
On top of the password, a second proof is required: a code received by message, a code generated by an app, or a physical key. Even if your password is stolen, access stays blocked.
The options, from least to most secure
- Code by text message: better than nothing, but vulnerable to certain types of fraud.
- Authenticator app: a code that changes every 30 seconds. A good balance.
- Physical security key: the most robust, ideal for critical accounts.
Where to turn it on first
- Business email.
- Banking and payment tools.
- Website hosting and domain name.
- Accounting software, CRM and cloud storage.
- The business's social media accounts.
Recovery codes
When you turn it on, store the backup codes in a safe place (password manager or vault). They let you regain access if you lose your phone.
With employees
Make it mandatory for all shared or sensitive accounts. Explain why: it's the most effective protection against account takeover.
