MFA basics: turn it on before you need it

By Don Zurbrick · Sample issue

Multi-factor authentication (MFA) means a password alone isn't enough to get into an account. You also need a second proof, like a code from an app on your phone. CISA puts it simply: people who turn on MFA are significantly less likely to get hacked, because a stolen password by itself no longer works.

The one thing to do today

Check whether MFA is on for your business email. If it isn't, turn it on. Email is the key to everything else, because it's where password resets go.

Where to turn it on next

Banking and payroll
Accounting software
Remote access to your office network or computers
Your website and domain registrar account

Which kind to use

Any MFA is better than none. If you have a choice, an authenticator app beats a text-message code. The strongest option is phishing-resistant MFA, such as a security key or passkey, which CISA calls the standard to aim for.

One warning for your team

If your phone asks you to approve a sign-in you didn't start, tap Deny and tell your IT person. Attackers sometimes send prompt after prompt, hoping someone taps Approve just to make it stop.

Sources: CISA: More than a Password · CISA: Turn On MFA