Layer 04 of 6Included from the Silver tier
The right people, the right access.
Multi-factor authentication, and permissions that match what someone actually does.
What it actually is
Assume a password will eventually be known by someone else. MFA makes that insufficient on its own, and it is the highest-value control available to a small business. The quieter half is permissions: access accumulates as people change roles, until everyone is an administrator.
Why it matters
A stolen or reused password is the simplest way into a business. The attacker does not break in. They sign in.
Without this layer
A password reused from an unrelated breach opens your email, and someone reads it for weeks.
What we do about it
- MFA enforced across email and cloud apps, administrators included
- Access set by role, and removed the day someone leaves
- Sign-in activity watched for the patterns that mean a stolen password
The jargon, translated
- MFA
- Multi-Factor Authentication: something you know plus something you have, so a password alone is not enough.
- Least privilege
- Everyone gets the access their job needs, and nothing left over from an old role.