Security
If you only do one security project this year, make it multi-factor authentication
Why MFA everywhere is the highest-value control for a small agency, and how to roll it out without a revolt.
When an agency with a small IT team asks where to start on security, our answer is almost always the same: multi-factor authentication on everything that faces the internet, starting with email and remote access.
Why this one
Credential theft is the most common way into an organization. Phishing, password reuse, and infostealer malware all produce valid usernames and passwords. Multi-factor authentication makes those credentials insufficient on their own. It is also a prerequisite for cyber insurance, for CJIS compliance, and for any Zero Trust roadmap.
Where to apply it
- Email and productivity platforms
- VPN and remote desktop
- Administrative access to every system
- Cloud consoles
- Finance and HR systems
- Any public-facing application that staff log into
Choosing a method
Authenticator apps are the practical default. SMS codes are better than nothing but are the weakest option. For administrators and high-risk roles, hardware security keys or platform authenticators that resist phishing are worth the cost. Conditional access policies can reduce prompts for staff on managed devices in known locations, which helps adoption.
Rolling it out
Start with IT staff and administrators. Then pilot with a friendly department, fix the enrollment guidance, and expand. Communicate early, provide a help desk path for people who lose their phone, and set an enforcement date. Shared accounts and service accounts need a plan of their own, usually elimination or a vault.
What it does not fix
Multi-factor authentication does not stop a user from approving a push notification they should not have, which is why phishing-resistant methods matter for sensitive roles. It does not protect unpatched servers or unmanaged devices. But it closes the most common door, and it can be done in weeks.