Introduction to MFA
The security problem
Let’s say you want to log into a website app. After entering your username, you go to enter that familiar password. This normally completes your sign-in process and can continue with your business.
However, if you’re one of the 54% of consumers who, according to TeleSign, use five or fewer passwords for all their accounts, you are a goldmine to hackers. They can gain access to any of your accounts by simply guessing or stealing one those passwords.
The good news: There’s an easy way to protect your account. It’s called multifactor authentication (MFA) and CorVantage employees benefit from it.
What does MFA mean?
Multifactor Authentication, or MFA, sounds like a complex security system. It’s actually very easy to understand. For the most part, security access has been protected by one of three components: something you know (a password, a PIN number), something you posses (a smart badge, a smartphone), or something you are (your fingerprint, your face).
Typically, accessing an account has been protected by one component, a password. MFA enhances our security by requiring two different components. With MFA active, employees have found it simple to use on a regular basis. Here’s what it looks like: When you go to sign in with your CorVantage email and password, you will be prompted to push a button on an app in your smartphone. That’s it – sign in complete!
Can I decline to activate MFA?
The short answer is no. We understand that security and convinience often do not go hand in hand. However, we frequently hear from employees that the most complex part of MFA is going through the setup process. Below are several reasons why CorVantage requires all employees activate MFA on their accounts.
COMPANY DATA ACCESS
Like we mentioned before, an Office 365 account has the potential to access a lot of intellectual company or sensitive employee data from anywhere in the world.
INCREASE in TARGETTED ATTACKS
Microsoft has had a lot of success with Office 365. With millions of accounts worldwide, hackers frequently target their phishing and breach attacks on these users.
SECURITY COMPLIANCE
CorVantage works on several highly-confidential projects. We are, therefore, required to be NIST and CMMC compliant. MFA is a critical component of those security policies.
Frequently Asked Questions
Here is a list of the most frequently asked questions employees have at this point.
Do I have to carry my cell phone with me to sign in?
Initially, you will be frequently asked to verify your sign-in using the MFA app on your smartphone. Eventually, as MFA learns your sign-in behavior, most of your sign-in sessions will not require MFA. Nonetheless, a sign-in may be flagged for MFA for any number of reasons. That is why you should always have your smartphone with you if you are planning to work on client or CorVantage projects.
When/how often will I need to utilize MFA?
You may need to utilize MFA whenever you are logging in with your CorVantage credentials. For example, a website session (e.g. Outlook Web, Sharepoint) or a desktop program (e.g. Microsoft Teams, Outlook). Microsoft Azure, which powers our MFA solution, will learn from your sign-in behavior over time, which will reduce the number of times MFA is required during a sign-in attempt.
Also, some web and desktop applications offer you options like “Stay signed in” or “Remember my credentials” during the login process. Microsoft will allow your session to remain logged in for a period of time so that you can return to it without signing in or using MFA.
What if my cell phone battery dies?
Not all account sign-ins will require MFA verifications. We have never had an issue with someone unable to sign-in during a period where their smartphone was dead. At the end of the day, if you are ever locked out of your account due to a dead or lost cell phone, IT Support is available to assist you. We can temporarily disable MFA requirements until you have access to your phone again.
What if I get a new smartphone?
Reach out to IT Support as soon as possible. We can assist you with getting MFA reactivated on a new smartphone device.
Does MFA affect how I log into my computer?
If you are using a CorVantage laptop, MFA unlocks the ability to quickly sign into your laptop using a PIN number and/or fingerprint reader (if your laptop has this feature). This is a one-time setup process and typically does not require MFA afterwards.
If you are using a client computer, MFA does not affect or change your computer login process.
Does the MFA app load data or email to my phone?
No. The Microsoft Authenticator app doesn’t download any company or email data whatsoever, nor can you view any company or email data inside of it. It is only a tool that helps verify your identity when you log in with your CorVantage credentials.
Can CorVantage track my phone with the MFA app?
The Microsoft Authenticator app does not have or use any GPS tracking features. Both iOS and Android app stores confirm that the app only needs permissions for notifications and camera (for the QR code scanning).
Any additional apps that have access to company data (e.g. Outlook/email, Teams/files) will have the ability to remotely wipe data from your phone if it is ever reported as lost or stolen.