Avoid MFA Pitfalls and Lockouts

Maybe you have seen the meme about spending 6 hours per day entering multi-factor authentication (MFA) codes. While inconvenience is one pitfall of MFA, improper configuration and management of MFA can lead to more damaging pitfalls and lockouts. Your ability to work can take days to recover.

The MFA Pitfalls 

Most of us are not using a separate security key; we authenticate using our smartphones. Whether by Authenticator app, SMS text, one-time passwords/codes, or local app login, we need our smartphone to access our apps and services.

Imagine this scenario:

• Your iPhone is lost, stolen, or damaged.
• On your laptop, you need to login to check email and the authentication goes to the Authenticator app on your phone.
• You could opt to have a one-time password emailed to you, but you cannot access your email.
• You could send it to your recovery email, which you rarely use, is logged out and the MFA also goes to your phone.

You get the picture. You are stuck, but you still have other means of access. Depending on your configuration, restoring access may be complex and take too much time.

And while this scenario may seem unlikely to happen, we see online forums where over 80% of help requests relate to account lockout and recovery. Almost all of the problems were avoidable with proper configuration and management.

Tips to Avoid MFA Pitfalls

To help you avoid MFA pitfalls and lockouts, we created a list of things to consider when configuring management of your MFA services.

• Use a Sustainable Phone Number for MFA and for Recovery: MFA texts and messages should only go to a phone number that can remain in use if you switch phones or phone systems. Whether to a physical phone or a VoIP service, make sure that you will not lose your number if things change in the future.

• Have a Separate Recovery Phone Number: If your phone is not available for MFA calls or texts, it is not going to work for recovery codes, calls, or texts. If at all possible, use different phone numbers for MFA and recovery. If your MFA phone number is your smartphone, your recovery phone number could be your business’ VoIP phone number, or the number of a trusted coworker or spouse.

• Use a Separate Recovery Email: If the email account that receives MFA messages is inaccessible, you will not be able to use it for recovery. Use an alternate email address. This could be a personal (@gmail.com) account or a one belonging to somebody you trust. When setting up your recovery email account, make sure that account is not reliant on the same methods and devices.

• Stop Before You Drop: Before you give up, abandon, or change a phone number or email address, review the MFA setup across all of your apps and systems. Make sure you move them to your new number and/or email address before you give up the old ones.

• Backup Your Authenticator Apps: Both Microsoft Authenticator and Google Authenticator let you backup your Authenticator App data. This lets you reinstall and recover your Authenticator settings and accounts on a new or different device. Make sure, however, that the backup location does not require the Authenticator App for access.

• Create, Print, and Save Recovery Codes: Many systems, apps, and security tools let you create emergency recovery codes. If available, create the codes, print them, and keep them in a safe location (“Put it with your Passport”). Having these codes can reduce account recovery time by hours or days.

• Use a Password Manager: Password managers provide a single, secure login to allow access to complex passwords and validation for the connected apps. Using a password manager reduces the risk of account lockout.

• Do Not Buy Direct: Buy your cloud apps and services through authorized partners. For most SaaS and cloud solutions, your partner has administrative access to your account. They can reset passwords and recover accounts. If needed to expedite access or recovery, your partner can change MFA configuration and/or temporarily remove MFA from an account.

These steps require some planning. As MFA settings and preference can often be set individually, you will need to communicate and coordinate with your employees. 

We Will Help

Our Cloud Advisors are here to assist. We can:

• Review your current MFA services and configurations
• Identify risks and recommend changes
• Assist your team members with settings and recovery codes
• Provide your with Password Manager services
• Provide license and account co-management for your cloud services

Schedule time with one of our Cloud Advisors now to discuss your next steps.

About the Author

Allen Falcon is the co-founder and CEO of Cumulus Global.  Allen co-founded Cumulus Global in 2006 to offer small businesses enterprise-grade email security and compliance using emerging cloud solutions. He has led the company’s growth into a managed cloud service provider with over 1,000 customers throughout North America.