What is two-step verification (2FA)?
In short
Two-step verification (2FA) means logging in with two proofs: your password plus something you have or are, such as a code from an app, a security key or your fingerprint. Someone who only has your password cannot get in.
How does two-step verification work?
After your password, the service asks for a second proof. The common forms are:
- Code by text message: simple, but the weakest, because text messages can be intercepted or redirected.
- Authenticator app: an app such as Microsoft Authenticator or Google Authenticator shows a code that changes every thirty seconds, or asks you to confirm a notification.
- Security key or passkey: a physical key or a key stored on your device, unlocked with your fingerprint, face or PIN. These are the most resistant to phishing.
Two steps are also at the heart of strong customer authentication at banks (see PSD2) and of logging in with DigiD at a higher level.
Why does it matter for businesses?
Stolen or guessed passwords are a common way in for attackers. With two-step verification, a stolen password alone is not enough. For organisations covered by NIS2, strong authentication is part of the measures the law requires.
How do you introduce it?
- Start with the accounts that matter most: email, admin accounts, accounting, the bank and your cloud storage.
- Where possible, make it mandatory for all employees instead of leaving it to each individual.
- Keep the recovery codes safe, for example in a password manager, and arrange what happens if someone loses their phone.
- When choosing new software, pick a package that supports two-step verification or logging in with your own company account (single sign-on).
Which software helps with this?
A business password manager stores strong passwords and often the codes for two-step verification too, and lets you grant and revoke access per employee. Also check that every package you use supports 2FA or logging in with your own account (single sign-on).