The importance of MFA – why you really need to have it set up in 2022

Multi-Factor Authentication – why it matters for you and the organization  

It’s very simple. We apply the ‘zero trust’ principle here. Devices should not be trusted by default. In principle, we trust no one. Not even a device. Regardless of which device you use or which application is involved, you must log in with your password. And you know how it goes. You know you shouldn't use easily guessable passwords, that you often forget them if you don't keep track of them, and that there shouldn't be too much routine or similarity between your passwords. The goal of MFA? Security! And preventing data breaches.  

So, how do you log in now? And what is the best way to do that for yourself and the organization? By default, we exclude. This means we verify that it is actually you trying to log in to your device. And we need a process to check that. With Multi-Factor Authentication, there are several ways to do this. Think of confirmation via SMS (this method is less secure, as it is more susceptible to spoofing and phishing), the mobile authentication app, or logging in with your Face ID or fingerprint.  

Joe's TIP: always check if you initiated the request yourself before accepting it.

At TeamValue, for example, we also use Azure Sentinel to monitor how colleagues log in in terms of authentication. This allows us to measure how secure our organization is regarding logins. It shows that the majority do so using the mobile app or Face ID. If you want to read more about this, check out A picture is worth a thousand words – visualizing your data. – Microsoft Sentinel 101 (learnsentinel.blog) or keep following this blog series, as Hendrik will soon be doing a deep dive into monitoring with Azure Sentinel.  

4 simple steps to keep your passwords secure

We have put together a short step-by-step plan for you to immediately check if you are secure enough, or to know where to take action if you aren't.  

1. Set up MFA. It sounds logical, yet there are still plenty of people who haven't done this individually. Make sure you install it not only on your work devices but also on your personal devices. Minimize the chance for hackers to access your data!

2. Use a Password Manager. Think of tools like LastPass, though there are many others, of course. The importance of this? You keep everything safe in a proverbial vault. Logging in with a Password Manager is also much faster because they are entered automatically. Win-win, right?  

3. Have your passwords generated by your Password Manager. If you're already using such a tool, let the system work for you and make use of the standards and password suggestions provided. The system can come up with much better options than you can, creating passwords with a good combination of characters and numbers. Often, the rule is: the longer the password, the more time it takes for a hacker to crack it.  

4. Make sure all your passwords are different. It may seem obvious, but if someone does gain access to your credentials, you want to ensure they cannot simply log in to other systems using the same password.  

Want to know more?  

• LastPass reports hack, but password resets are not necessary - Computer - News - Tweakers
• Security advisory warns of leaked passwords - appletips

Microsoft Defender for Cloud – MFA is worth at least 10% of your secure score

So far, you have found tips on what you can check as an organization and what you can do as an individual to keep your passwords as secure as possible. Did you know that Microsoft Defender for Cloud also provides plenty of tips to increase your so-called 'secure score'? Setting up MFA alone accounts for 10% of the value. Do you want to know what you need to do as an organization for the other 90%? Keep following this blog series, in which Marco explains which other recommendations you can apply and how to secure that ISO 9001/27001 certification.  

Joe's final tip: MFA and Password Managers exist for a reason. Use them! Otherwise, sooner or later, it will be your turn. And believe us, in this case, prevention is better than cure. So, do you still have passwords like Hello123? Change them immediately using your Password Manager 😉