How can municipalities better protect sensitive information like their employees’ computer login data? Deciding where to focus information security efforts for the most protection and the best return on investment can be a challenge. Multi-factor authentication is an excellent place to start.
What is multi-factor authentication?
Multi-factor authentication is a method of verifying computer system users’ identities before granting them access to a system. As the name implies, multi-factor authentication uses two or more different factors to verify a user’s identity before allowing them access to a given system, location or account.
These factors can include several things:
- Something the user knows, such as a password or a personal identification number, or PIN.
- Something the user is, such as facial recognition or a fingerprint.
- Somewhere the user is located, such as only accessing specific information or systems while on-premise at a given location.
Why implement multi-factor authentication?
If people can gain access to a municipality’s systems with a password alone, that system is highly susceptible to common cyberattacks. Too many users also reuse their passwords across multiple logins.
However, when a city implements multi-factor authentication, a password is only one of multiple components needed to gain access. Multi-factor authentication provides built-in barriers to entry that require relatively little investment of time and resources. It is often a requirement to purchase cyber liability insurance.
Which systems should you prioritize for multi-factor authentication?
Not all systems require multi-factor authentication. Here are some recommendations for top priorities:
- Any internet-facing service such as email; virtual private networks, or VPNs; and cloud-based systems.
- Systems housing sensitive data, such as personal health information, or PHI; financial information or other proprietary data and information.
- Critical Infrastructure such as firewalls, switches, servers and other critical infrastructure.
- Administrative accounts.
- Workstations.
Implementing multi-factor authentication is one of the most cost-efficient methods to protect a municipality against cyberattacks. Even if the city requires users to update their passwords regularly, those passwords may already be compromised and available on the dark web. Adding layers of authentication reduces your risk and could save thousands of dollars in the long term.