Let’s start the second quarter of the year with boosting our security posture by adopting two-factor authentication methods on our accounts to make them more secure. Two-factor authentication (2FA) is an identity and access management security method that requires two forms of identification to access resources and data. The first factor you provide is a password (often referred to as something you know.)  

In addition to the password, you must provide another form of identification that is not memory dependent (often referred to as something you have, such as a smartphone or a physical token.)

By simply enabling 2FA on your accounts, you gain an additional layer of security beyond just a password. This extra verification method means that even in the worst-case scenario if a social engineering attack is successful and someone gets your password, it will be much harder for them to gain access to your sensitive data without that other device to complete the login process.

And no, this does not mean you can use a weak password and certainly not reuse any passwords. A password manager is your friend, enabling you to generate unique passwords for every account. Stolen, reused, and weak passwords remain one of the leading causes of data breaches.

Even before considering 2FA, a password manager can go a long way in improving your security. Not only can a password manager simplify your online activities by generating unique passwords for each site, but it can also prevent you from logging into fraudulent sites by accurately recording the correct URL.

This way, if a criminal tries to trick you with deceptive spellings, such as nnicrosoft.com or abobe.com, the password manager will not fill in your credentials. Password managers can also be set with extra security by enabling 2FA.

The “2FA All the Things” Challenge

Dubbed “2FA All the Things” – I challenge you to enable 2FA on all your personal accounts. You probably have login credentials to dozens of online services that support 2FA. The objective here is to use a 2FA method that is more secure than SMS-based methods if you have the option.

This is because SMS text message 2FA is the least secure method. It’s certainly better than no 2FA because just a username and password alone is a weaker position to be in. SMS messaging is inherently insecure and is vulnerable to SIM swap attacks.

There are many authenticator apps to choose from, and they are all free. If you are more comfortable with a physical token, there are great options for those as well, although they incur a separate cost. Once you have your second factor in place, log in to all your personal accounts and set up 2FA.

All accounts that support 2FA have an area where you can set up the multi-factor feature, often under the “Privacy and Security” settings.

The best way to prioritize which accounts to add 2FA to is to choose the ones that hold the most valuable data, and the ones that you use most often. Most banks have mandated 2FA for online banking, and if your bank has not done so, that should rank first on the list.

Any accounts that store your credit card information, such as shopping sites and payment sites should follow close behind.

When we think about how dependent we have become on the online experience for so many of our transactions, it makes sense that the security of protecting those accounts outweighs any perceived inconvenience of enhanced protection.

2FA is the simplest way to add an extra level of protection to your valued assets.