Best practices for multi-factor authentication

Protect data with MFA & 2FA

One of the most effective ways to protect online accounts and data from malicious people and software is Multi-Factor Authentication (MFA). MFA requires people to identify themselves through multiple factors of authentication, by asking for:

1. Something you know, like a password or a PIN number.

2. Something you have, like a mobile phone, that can receive a verification code (such as One Time Passwords) or physical tokens like USB keys or product numbers.

3. Something you are, like fingerprints and facial recognition.

Two Factor Authentication (2FA) is the most common type of multi-factor authentication. It requires two identifiers to verify the user’s identity (for example a password and a verification code). These verification codes are also known as One Time Passwords, and they can be sent via a variety of different channels.

Sounds complicated, but using various types of multi-factor and two factor authentication is more common in our daily lives than you might realise. Have you ever received a text message with a verification code after you entered your password to access your social media? That's multi-factor authentication.

Best practices for MFA & 2FA

Though multi-factor authentication is a great ways to secure and protect data, it does require an extra step for users. Which often makes users (both employees and customers) hesitant to adopt it.

Customer MFA adoption

Let's start with your customers. You want to prevent chasing your customers away with complicated security measures, but you also want to keep them safe in your care. Setting up an account and signing up for your services should have a low-threshold, but it can't be too easy because you want to avoid spam and malicious usage. It's a delicate balance between implementing safety measures and retaining ease of use.

So, how can you strike a balance between user-friendly security measures and customer satisfaction? While there's no fail-proof solution (those are rare), there are certainly some key best practices to consider that can elevate the overall customer experience.

How to keep MFA user-friendly for customers

• Educate your customers on the benefits of MFA. If customers see the value of data protection, they'll become more willing to take that extra (security) step instead of viewing it as an annoying extra step that requires effort.

• Showcase your commitment to data security to build trust with your customers and encourage them to also take it seriously.

• Combat username and password fatigue. According to NordPass, the average internet user has between 70 and 80 passwords. That's a lot to remember! Help your customers by creating an easy-to-remember username for your services (for example just use their e-mail address as username)

• Be careful with your password requirements. It's good to encourage customers to come up with a password that isn't easy to crack, but the requirements have to be justifiable. Customers will give up if they have to invent a lengthy password with 7 unusual numbers, twelve capital letters, and some fairy dust.

• Give your customers the choice between different authentication options or channels. Customers are more likely to adopt your 2FA strategy when they can use channels they already use and trust.

• Give your customer a suitable amount of time to enter their verification code or One Time Password. Depending on connection, channel, and demographics, the verification process may take a while.

• Don't expect customers to adopt, purchase, or download another app, software, or device just to verify themselves. They will not be willing to do so.

• Allow your customers to "remember trusted devices" to minimise the need for log-ins. This is of course advised for low-risk cases. When sensitive data is at risk, repeated verification is a necessity.

Employee MFA adoption

Not only your customers need some convincing when it comes to adopting security measures; your employees will also need to be on board. The biggest exasperation for employees is logging into multiple software platforms and devices just to be able to do their job. It's important to find a way to secure and protect your employees and their data, without compromising their time and workflow.

How to keep MFA user-friendly for employees

• Be transparent about your security measures. Explain to your employees why the security measures are necessary, how they work, and why you chose to implement these specific measurements. Your employees will be more willing to adopt your security strategy when they understand the necessity.

• Stronger forms of authentication via third-party authenticator apps on the phones of your employees can work as a second layer of security on top of a strong password. An authenticator app can push a prompt to your employees, which they just have to click or tap to accept. No more copying and pasting codes.

• Use Single Sign-On (SSO) to make multi-factor authentication easier. SSO enables your employees to log in to multiple applications and websites with one set of credentials. This will optimise their time and improve their workflow.

Set up your own strong security policy today

Security measures are part of every modern company. Anybody that does business online should adhere to the security standards and regulations needed to keep themselves and their customers safe from harm. Security measures can be a necessary evil, especially when they disrupt the user experience or workflow of your employees. If your adhere to the best practices above, your security strategy should be balanced between keeping your data and services protected while protecting the ease-of-use for all involved.