October is Cybersecurity Awareness Month, and Alta Pro is doing its part to keep you safe and secure.
This post is Part 1 of our four-part Cybersecurity Awareness Checklist series. It will show you how to use Multi-Factor Authentication (MFA) to safeguard your online systems from intruders.
The National Institute of Standards and Technology (NIST) has identified four areas of emphasis for Cybersecurity Awareness Month 2022, starting with MFA:
- Enabling multi-factor authentication
- Using strong passwords and a password manager
- Updating software
- Recognizing and reporting phishing
Alta Pro’s Cybersecurity Awareness Checklist series will take a deep dive into each of the above-mentioned focus areas.
Alta Pro Insurance Services keeps you informed on cutting-edge issues that affect your practice. Every week the Pro Practice Blog posts timely and topical dispatches from the risk management front lines. We spot looming risks – like the possibilities and potential perils of cryptocurrency – and give you advance warning. We identify promising trends – like Micro Self-Care, Cybersecurity Ethics, and the One-Page Business Plan – and give you the inside scoop. We bring you live CLE webinars on topics you request, most recently “Managing a Law Practice in Uncertain Times.” Please let us know how we can help your professional practice minimize risk and maximize reward. We’re here for you.
Cybersecurity Awareness Checklist, Part 1
Multi-Factor Authentication
The following is from the National Institute of Standards and Technology:
- What is MFA? “Multi-factor authentication is sometimes called two-factor authentication or two-step verification, and it is often abbreviated to MFA. In simple terms, it creates two or more hurdles that must be cleared before anyone can access your system. Think of it as a password protected by another password, or a safety deposit box that can only be opened by a facial scan. [This] makes it extremely hard for hackers to access your online accounts, even if they know your password.”
- How does MFA work? “When you turn MFA on for an account or device, your log-in process will require a bit more verification. You will be asked for your username and password. If these are correct, you will then be prompted to prove your identity another way. You might be able to set up your smartphone, for example, to use a facial scan as verification. Other online accounts might send your phone number or email address a one-time use code that you must enter within a certain frame of time. Some accounts will require you to approve access with a standalone authenticator app like Duo or Google Authenticator.”
- What are the different types of MFA? “MFA can take several different forms, including:
- Inputting an extra PIN (personal identification number) as well as your password.
- The answer to an extra security question like “What town did you go to high school in?”
- A code sent to your email or texted to your device that you must enter within a short span of time.
- Biometric identifiers like facial recognition or fingerprint scan.
- A standalone app that requires you to approve each attempt to access an account.
- An additional code either emailed to an account or texted to a mobile number.
- A secure token (a separate piece of physical hardware, like a key fob) that verifies a person’s identity with a database or system.
- What accounts should be secured through MFA? “Not every account and device offers MFA, but it is becoming more common every day. You might already have it set up for your devices, like if you use a Face ID or fingerprint scan to unlock your phone or laptop. MFA is now often found in many workplaces and universities, too. Check to see if you can turn MFA on: Banking accounts, Email accounts, Social media accounts, and Online stores.”
- Be alert for danger signs. “While MFA is one of the best ways to secure your accounts, there have been instances where cybercriminals have gotten around MFA. However, these situations typically involve a hacker seeking MFA approval to access an account multiple times and the owner approving the log-in, either due to confusion or annoyance.”
- What should I do if I receive MFA log-in requests but I’m not trying to log in? “Do not approve the requests! Instead, contact the service or platform right away. Change your password for the account ASAP. Also, if you reused that password, change it for any other account that uses it (this is why every password should be unique).
CLICK HERE FOR PART 2 OF THE CYBERSECURITY AWARENESS CHECKLIST: PASSWORDS.
Source: NIST
Do you practice in Wisconsin, Texas, Minnesota, Ohio, Illinois, Indiana or Michigan? Is your professional liability coverage managed through Alta Pro? If so, you’re automatically a member of the Alta Pro Risk Purchasing Group (RPG), which offers a wealth of benefits for your practice: free, cutting-edge CLE webinars featuring top experts tackling timely topics; the Pro Practice Playbook; the Pro Practice Blog; Reminger’s ProLink risk management assistance; Reminger’s Claim Repair Hotline; discounts on CLIO practice management software; tax savings on health insurance; and access to the Risk Pro, who can help keep your firm safe and successful. Register here and start enjoying your Alta Pro RPG benefits.