How to get two-factor authentication right
It is rarely the thing that gets a project approved, and often the thing that decides how it goes. The short answer to two-factor authentication is that it is mostly a sequence of small decisions, not one big one.
Security is a maintenance habit rather than a purchase, which is why it drifts. Check it against what you would want a competitor's site to get wrong.
Why this earns attention
It stops the overwhelming majority of account takeovers. This is the sort of thing that compounds, quietly, in both directions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.
The steps
- Establish what you have today before changing anything
- App-based codes beat SMS
- Enforce it on anything that can publish or spend
- Write down the decision so the next person does not re-litigate it
Enforce it on anything that can publish or spend. None of that requires a large budget, only a decision and someone to own it. Doing this properly once is usually cheaper than doing it approximately three times.
A reasonable first step
The short version
The cheapest security work is the boring kind done on a schedule. Three things worth confirming about two-factor authentication before you move on:
- Someone can say what the current setup is without going to look
- App-based codes beat SMS — and you know whether that is true here
- There is a way to tell whether the last change to this helped
Pick the one that would hurt most if it failed, and start there.