System Security / Foundations
Protect accounts with more than a password
A stolen password should not be enough to open your business accounts. Multi-factor authentication (MFA) adds another verification factor, but the method you choose matters.
Environment and inputs: An approved disposable test account, the service’s current enrollment instructions, a separate browser session and a verified recovery method.
A stolen password should not be enough to open your business accounts. Multi-factor authentication (MFA) adds another verification factor, but the method you choose matters.
- Enable MFA wherever available. Start with email, administrator accounts, and services holding sensitive information.
- Prefer phishing-resistant methods. Where supported, use FIDO/WebAuthn options such as security keys or passkeys. SMS and one-time codes can still be phished.
- Keep access appropriate. Use unique passwords stored in a password manager, limit administrator privileges, and remove access when people leave.
One action today: Check whether your business email offers phishing-resistant sign-in.