Setting Up Two-Factor Authentication

Why Passwords Alone Are No Longer Enough

Credential breaches expose billions of passwords every year. The problem is not just that passwords get stolen; it is that the same password is frequently reused across multiple services. When attackers obtain credentials from one breach, they use automated tools to test those same combinations against dozens of other platforms. This technique, known as credential stuffing, works at scale because password reuse remains common.

Two-factor authentication breaks this pattern. It requires two separate types of proof before granting access: something you know, such as your password, and something you have, such as a phone or a hardware security key. Even if a password is compromised, an attacker cannot access the account without also possessing the second factor.

For businesses in the UK, the question is not whether to implement two-factor authentication but which systems to protect first, which methods to use, and how to manage the rollout without disrupting daily operations. This guide walks through that process practically.

Starting With the Systems That Matter Most

Not every system requires the same level of urgency when implementing two-factor authentication. Prioritise based on two factors: the impact if the system is compromised, and the likelihood that it will be targeted. High-value targets deserve protection first, while lower-risk systems can follow in subsequent phases.

Email and Communication Platforms

Email is almost always the highest priority. Your email account is typically the reset mechanism for every other service you use. If someone gains access to your email, they can request password resets for banking, cloud services, social media, and business tools. An attacker controlling your email effectively controls your digital identity.

If you are looking at email security more broadly, it is worth understanding how SPF, DKIM, and DMARC work together to protect against email spoofing and impersonation attacks alongside two-factor authentication.

Remote Access Solutions

VPNs, SSH servers, RDP gateways, and other remote access tools are frequent targets because they provide direct entry into your network. Anyone with remote working or server access should have two-factor authentication enabled without exception. These entry points are where automated attacks concentrate, making them a high priority for any security rollout.

Financial and Payment Systems

Banking portals, payment processors, invoicing platforms, and accounting software should be protected immediately. If your business handles payment data, it is worth reviewing your overall security posture and ensuring that two-factor authentication is part of your protection strategy for financial tools.

Identity and Administration Consoles

Admin panels for Azure Active Directory, Google Workspace, AWS, and similar platforms grant broad access across your entire technology environment. These accounts should use hardware security keys where possible, or at minimum TOTP authenticator apps. Compromising an admin account can expose your entire infrastructure.

Code Repositories and Development Platforms

GitHub, GitLab, and Bitbucket accounts with write access can be used to inject malicious code into software or to steal proprietary work. Protect these accounts with two-factor authentication and consider restricting access to specific IP ranges where possible. For teams building custom applications, a practical understanding of authentication security matters at the development level too.

Understanding TOTP Authenticator Apps

TOTP, or Time-based One-Time Password, is the most widely supported two-factor authentication method across business platforms. It generates a six-digit code that changes every thirty seconds. The code is computed from a shared secret stored on your device and the current system time.

When you enable two-factor authentication on a service, you typically scan a QR code with an authenticator app. This transfers the shared secret securely to your app. From that point, the app generates codes that match what the service expects.

For businesses, Authy is generally a better choice than Google Authenticator. It supports multi-device synchronisation, encrypted cloud backups, and biometric or PIN protection on the app itself. If a user loses their phone, Authy makes migration to a new device straightforward. Google Authenticator requires manual export and import of accounts, which many users find confusing during already stressful situations.

For those building custom applications, implementing two-factor authentication properly requires understanding how TOTP generates and validates codes. A PHP two-factor authentication implementation guide covers generating secrets, validating codes, and integrating authentication into web applications.

# Generate a TOTP secret and test a code locally

python3 -c "
import pyotp

secret = pyotp.random_base32()
totp = pyotp.TOTP(secret)

print(f'Generated secret: {secret}')
print(f'Current TOTP code: {totp.now()}')
print(f'Code valid for: 30 seconds')
"

Always store backup codes securely when you enable two-factor authentication. Use a password manager or print them and store them in a secure location. Do not store backup codes in plain text files, notes apps without encryption, or emails.

Hardware Security Keys for Higher Protection

Hardware security keys using FIDO2, WebAuthn, or U2F protocols provide the strongest form of two-factor authentication available. They are physical devices, typically USB or NFC-based, that perform cryptographic authentication when plugged in or tapped against a reader.

The key advantage is that hardware keys cannot be phished, are not affected by malware, and cannot be remotely extracted even if your computer is compromised. The private key never leaves the hardware token, making it fundamentally different from software-based authentication methods.

The most widely supported hardware keys are YubiKey devices, Google's Titan keys, and Feitian keys. YubiKey has the broadest compatibility across services and is the option most businesses choose when deploying hardware-based authentication.

# Example: Enabling security keys in Google Workspace

# Navigate to: admin.google.com
# Go to: Security > 2-Step Verification > Security keys
# Enroll registered security keys for admin accounts

# For individual users:
# myaccount.google.com > Security > 2-Step Verification
# Add security key following the browser prompts

Require hardware keys for your highest-privilege accounts: global administrators, users with billing access, and anyone with direct database or infrastructure access. For standard employees, TOTP apps represent a practical balance between strong security and everyday usability.

Rolling Out Two-Factor Authentication Without Disrupting the Business

A phased rollout reduces friction and helps users adapt. Enforcing two-factor authentication across an entire organisation simultaneously, without warning or preparation, typically creates support chaos and frustration that damages adoption rates.

Phased Implementation Timeline

1. Weeks 1-2: Enable two-factor authentication for the IT team and system administrators. Test account recovery procedures thoroughly. Document any issues that arise during this testing phase.
2. Weeks 3-4: Roll out to power users, department heads, and anyone with elevated access. Collect feedback about the process and any compatibility issues with existing workflows.
3. Weeks 5-6: Mandate two-factor authentication for all remaining users. Run short training or Q&A sessions to address common questions and concerns.
4. Ongoing: Monitor adoption rates, support users who are struggling, and ensure any new systems added to the environment have two-factor authentication enforced from day one.

Offer multiple authentication methods to accommodate different working patterns. Users who travel frequently may benefit from hardware keys or authenticator apps on multiple devices. Users without smartphones can use TOTP apps on basic phones or rely on hardware keys and backup codes.

Managing Account Recovery When Two-Factor Authentication Fails

Every two-factor authentication implementation must include a documented recovery process. Without one, a lost phone or a broken hardware key can result in permanently locked accounts, which disrupts operations and may require formal identity verification to resolve.

When two-factor authentication is enabled, most services generate ten to twenty one-time-use backup codes. Each code works only once. When codes are exhausted, most services allow you to generate a fresh set after logging in successfully.

# Best practice for backup codes

# 1. Generate them immediately when setting up 2FA
# 2. Store them in a password manager (1Password, Bitwarden, etc.)
# 3. Alternatively, print them and store in a secure physical location
# 4. Never store them in unencrypted files, cloud notes, or plain emails
# 5. Ensure more than one authorised person can access them for business accounts

For business environments, define a clear process for recovering accounts when a user loses their second factor. This should require verified identity, approval from a manager or administrator, and should be logged for audit purposes. Document this process and test it during your initial rollout phase before you actually need it.

Enforcing Two-Factor Authentication at the Identity Provider Level

If your organisation uses Azure Active Directory (now Microsoft Entra ID) or Google Workspace, you can enforce two-factor authentication at the identity provider level so it applies automatically to every connected service without configuring each one individually.

# Azure Active Directory / Microsoft Entra ID

# Sign in to: azure.microsoft.com > Entra ID
# Navigate to: Protection > Authentication methods > Authenticator app
# Enable for: All users (or select specific security groups)
# Require: Users must register 2FA before sign-in

# Google Workspace

# Sign in to: admin.google.com
# Navigate to: Security > 2-Step Verification
# Turn on 2-Step Verification for your organisation
# Set enforcement: ON for all users or specific organisational units

When two-factor authentication is enforced at the identity provider, users are prompted to register a second factor on their next sign-in. They cannot access any connected application without completing registration. This approach scales well and ensures consistent coverage across your entire software environment.

Monitoring for Two-Factor Authentication Bypass Attempts

After implementing two-factor authentication, attackers may attempt to bypass it using several known techniques. Understanding these methods helps you set up appropriate monitoring and alerts to detect suspicious activity early.

Common Bypass Techniques to Watch For

• Phishing of session tokens: Attackers create fake login pages that capture not just passwords but also the session cookie generated after successful two-factor authentication.
• SIM swapping for SMS-based 2FA: Criminals convince a mobile carrier to transfer a phone number to a device they control, intercepting SMS verification codes. This is why TOTP and hardware keys are preferred over SMS.
• Social engineering the helpdesk: Attackers call or email IT support claiming to be locked out, requesting removal or reset of two-factor authentication on their account.
• Authentication fatigue: Attackers trigger repeated login attempts to the victim's phone or email, hoping the user will approve one out of frustration or confusion.

# Azure AD sign-in log monitoring queries

# New location successfully authenticating
# Identity: [user@company.com]
# Sign-in logs > Location: any new country/city not previously seen

# Multiple failed two-factor attempts
# Sign-in logs > Result: failed
# Additional detail: MFA failed

# Impossible travel alert
# Sign-in from two geographically distant locations
# within a timeframe that makes physical travel impossible

Configure alerts for impossible travel patterns, logins from anonymous VPN or proxy IP addresses, multiple failed two-factor attempts, and successful authentications from new devices. These events often indicate either compromised credentials or active attack campaigns.

Securing the Wider Web Presence

Two-factor authentication is one layer of a broader security posture. For business websites and web applications, transport layer security plays an equally important role. Ensuring your site uses HTTPS and TLS properly protects data in transit between your users and your servers, complementing the protection that two-factor authentication provides at the account level.

When evaluating your website platform and overall security approach, it is worth understanding the differences between custom CMS development and managed platforms as they affect how authentication is implemented and maintained.

Additional Security Practices That Complement Two-Factor Authentication

Two-factor authentication works best alongside other security measures that reduce the overall attack surface of your business systems. These complementary practices strengthen your security posture without adding significant complexity to daily operations.

Regular Access Reviews

Review who has access to which systems on a quarterly basis. Remove access for employees who have changed roles or left the business. Access that was granted for a specific project should be revoked when that project ends. Regular access reviews prevent credential accumulation, where former employees or unused accounts remain active long after they should have been deactivated.

Password Manager Deployment

Pairing two-factor authentication with a password manager reduces password reuse and improves credential hygiene across your team. Password managers generate strong, unique passwords for every service and store them securely. When employees use a password manager, they are less likely to fall back on memorable but weak passwords that are easy to guess or crack.

Phishing Awareness Training

Even with two-factor authentication in place, phishing remains a threat vector. Train your team to recognise phishing attempts, verify email senders carefully, and avoid entering credentials on unfamiliar pages. Attackers increasingly craft convincing phishing pages that also capture two-factor codes, so user awareness training should cover the latest techniques.

Evaluating Your Current Two-Factor Authentication Setup

If you already have two-factor authentication in place, it is worth reviewing whether your implementation meets current best practices. Over time, platforms add support for stronger authentication methods, and what was adequate two years ago may now be considered outdated.

Check whether any of your critical systems are still relying on SMS-based codes. Review whether your administrative accounts have hardware keys or are limited to TOTP apps. Assess whether your backup code storage is secure and whether multiple people in your organisation can access recovery procedures if needed.

A practical security review of your current setup can identify gaps that need attention and confirm whether your authentication methods are appropriate for the sensitivity of the data each system handles.

Putting Two-Factor Authentication Into Practice

Implementing two-factor authentication across business systems is a practical step that meaningfully reduces the risk of unauthorised access. Starting with email and administrative accounts, using TOTP or hardware keys, and rolling out in phases keeps disruption manageable while building protection systematically.

Each system you protect with two-factor authentication raises the difficulty for attackers and reduces the likelihood of a successful breach. The effort involved in a phased rollout is considerably less than the effort required to recover from a compromised account or a data breach.

If you need help reviewing your current authentication setup, preparing a short summary of your existing platforms, user access patterns, and any specific concerns before getting in touch makes the conversation more productive. You can contact N. Cristea to discuss a practical review of your two-factor authentication implementation.