Welcome to the first part of our Brilliance in the Basics series. Today, we'll discuss the importance of configuring 2-Factor Authentication (2FA) for all your online accounts that support it, not just the ones you "think" are critical. I'd put 2FA among the most valuable cybersecurity basics—but it's not a silver bullet, and not all methods offer the same protection.
Understanding 2-Factor Authentication
2-Factor Authentication is a security measure that requires two distinct types of evidence for verifying your identity: something you know, something you have, or something you are. Two steps alone aren't enough: a password and a PIN are both something you know. See OWASP's explanation of authentication factors.
A common example is a password plus a code generated by an authenticator app on your phone. Authentication doesn't always require typing a password, though: a passkey with required PIN or biometric verification can combine possession of the credential with a second factor. A fingerprint or face scan typically unlocks the authenticator on your device; it isn't a standalone remote authenticator under NIST's biometric guidance. See also OWASP's passkey guidance.
Why 2FA Matters for All Your Accounts
- Interconnectedness: With the growing interconnectedness of our digital lives, even seemingly insignificant accounts can pose a security risk. Cybercriminals often exploit weak points in your online presence to gain access to more valuable information.
- Credential stuffing: Hackers use a technique called credential stuffing, in which they use stolen credentials from one account to access other accounts that share the same username and password.
- Identity theft: Cybercriminals can use information from less critical accounts to build a profile of you, which can be used for identity theft or targeted attacks.
Key Takeaways and Action Steps
- Recognize the value of 2FA: Understand that 2FA is a powerful security measure that can help protect your online presence, not a guarantee against every attack.
- Set up 2FA on all your accounts where available: Don't just limit 2FA to your most critical accounts.
- Prioritize strong authentication methods: Choose phishing-resistant options such as FIDO/WebAuthn security keys or passkeys with PIN or biometric verification where supported. Authenticator-app codes are a useful fallback, but manually entered codes—including SMS codes—are not phishing-resistant, as NIST explains. Prefer an authenticator app over SMS when those are your choices; if SMS is the only option, using it is generally better than leaving MFA off. See OWASP's guidance on SMS authentication.
- Stay vigilant: Regularly monitor your accounts for suspicious activity.
Stay #CyberSmart!