Why multi-factor authentication should be the default

The most common way business accounts are taken over is not a sophisticated attack but a password that has somehow been learned: a password leaked from another site and reused, details typed into a fake sign-in page, or simply a guessable password.

Multi-factor authentication (MFA) asks for something the user has in addition to the password: an app on a phone, a security key or a check tied to a device. Even if the password is stolen, the account cannot be opened with it alone.

Why “optional” is not enough

When MFA is switched on only for users who ask for it, attackers naturally target the accounts without it. Administrator accounts, shared accounts and accounts unused for a long time are often in that group. The weakest link determines the strength of the whole.

That is why MFA should be on by default across the organisation, with exceptions defined in writing, with a reason, and kept to a minimum.

Which method?

Not all methods offer the same protection:

• Codes sent by SMS are better than nothing, but they are exposed to number porting and message redirection attacks.
• An authenticator app is safer and a good starting point for most users.
• Push approval is easy to use; it should be combined with extra checks such as number matching to resist repeated approval requests.
• Hardware security keys and passwordless sign-in methods offer the strongest protection against fake sign-in pages and are recommended for administrator accounts.

Rolling it out without wearing users down

The main obstacle to MFA is that users dislike an extra step at every sign-in. That burden can be reduced by:

• Asking for verification less often on recognised devices and the organisation’s network.
• Using single sign-on so one verification opens all applications.
• Announcing the change in advance, preparing a short guide and offering support during the first week.

A recovery plan

Define in advance how a user who loses or replaces their phone regains access. The recovery process should include identity checks so that it does not become a door attackers can open through social engineering.

The result

MFA is not a security project but a basic setting. When it is on by default, it blocks most of the common account takeover scenarios an organisation is likely to face.