Clark: Multi-factor authentication is crucial for business security
Last week, I highlighted the importance of effective password management. However, even the most intricate passwords can fall short if other critical security measures are overlooked.
At a recent NationaLease event, Russ Abdrakhmanov, founding leader of neKey Cybersecurity, revealed a glaring example of security lapses leading to a catastrophic breach. A well-known oil transport company, responsible for transporting 1.5 million barrels of oil daily across a 5,500-mile stretch across the U.S., fell victim to a ransomware attack, halting operations for the first time in 57 years. This incident traces back to an employee who departed the company, leaving behind a complex password. Unfortunately, the company failed to deactivate this employee’s VPN access, inadvertently leaving a backdoor open. Hackers, having acquired the password from an unrelated data breach, exploited this oversight, siphoning off 100 gigabytes of critical data and costing the company $4.4 million in bitcoin. It took five days to restore operations, during which 7.5 million barrels of oil couldn’t be delivered.
What missteps did this company make? According to Abdrakhmanov, they lacked modern detection systems, had vulnerable software, reused passwords extensively, lacked a robust backup plan, had poor IT procedures, and did not implement multifactor authentication.
See also: Advancing fleet intelligence
Why is multi-factor authentication so essential?
Multi-factor authentication (MFA) adds an extra layer of security by requiring users to verify their identity with more than just a password. As described by the Cybersecurity and Infrastructure Security Agency, "MFA is a layered approach where a system demands two or more credentials to validate a user's identity." This significantly enhances security because even if one credential is compromised, unauthorized access is thwarted by the additional authentication step.
In simpler terms, Amazon Web Services defines MFA as a "multi-step login process that goes beyond passwords." Implementing MFA could have made the breach much more challenging for hackers to execute.
Abdrakhmanov advises businesses to adopt a comprehensive MFA strategy:
- Implement MFA universally, starting with email accounts, and extend it to all remote access and VPNs. Make 2FA (two-factor authentication) mandatory for all users.
- Ensure all administrator accounts, including Office365, are protected with 2FA.
- Establish secondary recovery methods and designate multiple global admins with 2FA protection, ensuring IT vendors are part of the security framework.
While MFA isn’t foolproof, it significantly enhances your security, making it an indispensable safeguard in today’s digital landscape. Cybercriminals are constantly evolving their tactics, but MFA raises the bar by adding friction to their efforts—forcing them to invest more time, more resources, and take more risks to achieve their goals.
For many, that added difficulty is enough to make them move on to a softer target. And for businesses, the cost of implementing MFA is minimal compared to the financial, operational, and reputational damage of a breach. Think of MFA not as a hassle but as a fundamental layer of defense—one that can help preserve customer trust, ensure business continuity, and protect the data that keeps your organization running. In a threat environment where it’s no longer a matter of if but when you’ll be targeted, MFA isn’t just a best practice—it’s a business imperative.
