Passwords are broken. We've known this for years — they're reused, phished, guessed, and stolen at industrial scale. The solution isn't a stronger password; it's a second factor of authentication. Multi-factor authentication (MFA) is the single most effective control available to prevent unauthorized account access, blocking over 99.9% of automated attacks.
How MFA Works
MFA requires users to prove their identity using two or more of these factor types:
- Something you know — password or PIN
- Something you have — phone (authenticator app or SMS), hardware token, smart card
- Something you are — fingerprint, face recognition, other biometrics
Even if an attacker has your password, they can't log in without the second factor.
MFA Methods: Best to Worst
- Hardware security keys (FIDO2) — YubiKey and similar. Phishing-resistant. Best protection available.
- Authenticator apps — Microsoft Authenticator, Google Authenticator. Time-based one-time codes or push notifications. Excellent protection, easy to use.
- SMS codes — Better than nothing, but vulnerable to SIM swapping attacks. Avoid for high-value accounts if possible.
Implementation Priorities
Start with your highest-risk accounts:
- Email (especially admin and executive accounts)
- Any admin or privileged accounts
- VPN and remote access
- Cloud platforms (Microsoft 365, Google Workspace, AWS)
- Financial accounts and banking
- All remaining business accounts
Microsoft 365 MFA Setup
If your business uses Microsoft 365, enabling MFA takes less than 10 minutes in the admin center and immediately applies to all user accounts. Enable it through Security Defaults or, better, configure Conditional Access policies for more granular control.
Managing User Resistance
The most common obstacle to MFA adoption is user resistance — "it's an extra step every time I log in." Address this with:
- Trusted device registration (only require MFA on new devices)
- Number matching and additional context in push notifications
- Clear communication about why MFA matters
- Training sessions that take less than 15 minutes
Need help rolling out MFA across your organization? Zirkle Tech can manage the entire implementation, including user training, for Cleveland businesses of any size.