IT security is a growing field precisely because so many businesses lack suitable digital security. If news headlines are to be believed, no one is safe from the long arm of the hacking community. Even institutions that are supposed to employ the height of security (medical organizations, banks, and government entities, for example) have been subject to data breaches, and that’s just in the last year alone. What is the average business to do in light of such overwhelming odds? How can small and mid-size companies protect themselves from security breaches, data loss, and identity theft (not to mention the major fallout after a breach) when bigger, better-funded entities can’t fend off hackers?
In truth, there is no shortage of steps businesses can take to protect themselves and their clients from data theft. Simple steps like installing appropriate firewalls and encryption programs are a good start, as is hiring professional help like document shredding services, monitoring websites, and even managed services providers. The problem for many smaller businesses, however, is not a lack of motivation to upgrade security, but a lack of capital to devote to the project. Enlisting the aid of a managed services provider, for example, can cost a pretty penny.
One good option for many businesses looking to implement a major change without spending a ton of money is to institute a 2-step verification process for user logins for company systems. You may already have password protections in place for both employees and customers. If you’re smart, you’ve already taken steps to make this login process as secure as possible. Perhaps you require strong passwords, such as those that are eight characters or longer and that must use letters, numbers, and symbols. You may prompt users to change their passwords frequently. Maybe you even use a program that doesn’t allow users to save information and that won’t repopulate fields when any portion of the login data is incorrect.
This type of diligence is both wise and secure. However, 2-step verification can take your login process to the next level in terms of security. As you may know, offering 2-step verification means adding another step to the login process, and there are a couple of ways to go about it. You could, for example, require users to answer a security question (i.e. “what is your maternal grandmother’s name” or “where were you born”). This creates an extra layer of security by requiring additional, unique information from every user.
The other form of 2-step verification is even more secure. You could also require users to enter an authentication code after entering a username and password. This can be accomplished when users download an app that generates unique codes and refreshes after a short time frame (say one minute), providing a new code. Or you could simply send out unique codes to user phones for them to enter when they’re trying to log in to your system. It is this type of 2-step verification that most companies are leaning toward these days as a means of stopping hackers from breaking in by figuring out user login data.
Will this truly make your system more secure, though? Unfortunately, 2-step verification isn’t entirely foolproof. It definitely adds an extra layer of security, and will therefor stymie a certain segment of the hacking population, which will likely move on to easier targets. However, there are some flaws in the system that data thieves have learned to exploit.
The main problem can be account recovery. Suppose a user loses data and cannot access an account, commencing the process of account recovery. Businesses don’t want users to lose their accounts and the data they’ve generated, so most simply bypass the verification system or disable it in order to allow users to create new login information. With minimal data, hackers can exploit this process to gain access to user accounts, thus nullifying 2-step verification.
The hope, of course, is that users will be smart with their own data management, creating unique passwords and optimal protections for all of their accounts so that hackers can’t gain access to recovery data. However, this is not always the case. In the meantime, 2-step verification is just one more way to add protection. For companies looking for relatively affordable ways to increase security, it’s a great option to explore.