Two-Step Login for Your Business Accounts: Where to Turn It On First
A freelance bookkeeper gets a message from her email provider: a new sign-in from a device she does not recognize. It turns out to be nothing. But for a minute she realizes that one password stands between a stranger and every client conversation she has ever had.
That is what multifactor authentication, often called two-step login, is for. It asks for a second proof besides your password, so a stolen password is not enough on its own.
What CISA means by multifactor
CISA, the US cybersecurity agency, describes three kinds of proof: something you know (a password or PIN), something you have (a code from an app or a text message) and something you are (a fingerprint or face scan). Multifactor means using two or more of them together.
The agency lists the accounts to protect: email, financial services, social media, online stores, and gaming and streaming services. For a small business, the first four are the ones that matter.
Start with your email
If you can only secure one account today, make it your business email. It is where password resets arrive, so whoever controls it can often take over everything else. Then move to your bank and payment accounts, your online store and your social media.
Which method to choose
- Strongest: CISA calls phishing-resistant MFA the best option, and says the widely available choice is FIDO/WebAuthn, which prevents logins to fake websites.
- If that is not offered: CISA points to number matching, which helps against push-notification bombardment and text-message based attacks.
- Whatever you can get: CISA's own wording is that any MFA is better than no MFA.
Five minutes, four steps
- Open the security settings of the account.
- Look for "Two-Factor Authentication", "Multifactor Authentication" or "Two-Step Verification".
- Turn it on and follow the prompts.
- Save any recovery codes somewhere safe, away from the device you log in with.
If a service does not offer MFA at all, CISA suggests contacting the company and asking them to add it.
Where Edwin fits
When you connect your mailbox to Edwin, a digital assistant, that mailbox becomes even more central to your day, which is one more reason to protect it first. Edwin drafts and prepares, he always says he is an AI, and nothing important happens without your approval. He is not a security tool, and this article is general guidance, not security advice for your specific situation.