Two Factor Authentication: Protect Business Accounts

Two factor authentication adds a second step to your sign in, so a stolen password alone cannot open your account. For a small business, this is one of the cheapest ways to protect email, online banking and advertising accounts. It takes about five minutes per account. Better still, use an app or a security key, not a text message.

What it is and why it matters

A password is something you know. A second factor is something you have, like your phone or a small security key. When both are required, a thief who guesses or buys your password still cannot get in.

Passwords leak all the time. Staff reuse them, type them on shared computers, or give them to a fake login page. Email matters most. Whoever controls your business email can usually reset the password on every other account, including the bank and the ad account.

Sources: NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (June 2017, updated March 2020), pages.nist.gov/800-63-3/sp800-63b.html.

Pick the strongest second step you can

Not every second step is equal. Here is the order we suggest, from stronger to weaker.

• Security key. A small physical key that you plug in or tap. Google lists it among its second steps for accounts.
• Authenticator app. An app on your phone makes a fresh code every few seconds. It keeps working without a mobile signal.
• Prompt on your phone. You tap Yes on a message from a signed in phone. Google offers this for Google accounts.
• Text or voice code. A code sent to your phone number. It is better than no second step, but it is the weakest choice.

If an account offers only text codes, turn them on anyway. A weak second step beats none.

Sources: Google Account Help, 2-Step Verification, support.google.com/accounts/answer/185839; NIST SP 800-63B, pages.nist.gov/800-63-3/sp800-63b.html.

How to turn it on for a Google account

Many Vietnamese businesses run email and documents on Google accounts, so we use this as the worked example. The steps are short.

1. Sign in and open your Google Account at myaccount.google.com.
2. Open the Security settings.
3. Find 2-Step Verification and choose to turn it on.
4. Pick your second step. We suggest a security key, an authenticator app or a phone prompt.
5. Save the backup codes, if it offers them.

Backup codes are one time codes for the day you lose your phone. Print them or write them down. Keep them in a locked drawer or safe, not in the same email account they protect.

Sources: Google Account Help, 2-Step Verification, support.google.com/accounts/answer/185839.

Why text codes are weaker

A text code travels over the phone network and depends on your phone number. Someone who tricks a phone company into moving your number to a new SIM card can receive your codes. That attack is often called SIM swapping.

The US standards body NIST treats this as a real concern. In its 2017 authentication guidance, it labels text message codes as a "restricted" method. It tells services to consider warning signs such as a SIM change, a device swap or a number being ported to another carrier before they rely on a text code. It also says the provider must offer users at least one other choice that is not restricted.

The practical lesson is simple. If you have the choice, use an app or a key. If you must use text, keep the phone number private and tell your phone company to add a security note to your account.

Sources: NIST SP 800-63B, section 5.1.3.3 and section 5.2.10, pages.nist.gov/800-63-3/sp800-63b.html.

Where to turn it on first

Start with the accounts that can cause the most damage. Work through this list in order.

1. Business email. It can reset everything else, so it comes first.
2. Online banking. Look for a security or login settings page, or ask your bank which second steps it supports.
3. Advertising and social accounts. A hijacked ad account can spend your budget in hours. Check its security settings for a two step or two factor option.
4. Domain, website and cloud accounts. Losing the domain means losing your site and your email address.
5. Accounting and payroll tools. They hold customer and staff data.

Every service words this setting a little differently. Look for names like two step verification, two factor authentication, login approval or multi factor authentication. They all mean the same idea.

Habits that keep it working

• Use a separate account for each person. Do not share one login across the team.
• Never read a code aloud to a caller or send it in a chat. A real bank or platform will not ask for it.
• Check that the web address is right before you type a code.
• Keep a spare key or backup codes in a safe place.
• When a staff member leaves, remove their phone and key from every account the same day.
• Test your recovery plan once. Make sure two people can still get in if one phone is lost.

Two factor authentication does not stop every attack. A fake page can still trick a person into typing a code. But it blocks the most common one, a stolen password used from far away. For a few minutes of work, that is a good trade.

Sources: NIST SP 800-63B, pages.nist.gov/800-63-3/sp800-63b.html; Google Account Help, 2-Step Verification, support.google.com/accounts/answer/185839.

Sources

• NIST, Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, pages.nist.gov/800-63-3/sp800-63b.html
• Google Account Help, Turn on 2-Step Verification, support.google.com/accounts/answer/185839