Offer two-factor login

How to do it

Staff are your own people who run the admin tool or support. They use phishing-resistant factors only, which means passkeys or security keys, as NIST SP 800-63B-4 and CISA advise. Admins and owners of a customer organisation need any factor that is not SMS alone, such as an authenticator app or a passkey. Offer passkeys first to them and to every customer, as offer second factors from strongest to weakest says. Avoid text messages where you can, because numbers can be hijacked. Rate limit code entry, give one-time recovery codes, and ask again for the second factor before changing it. See also give recovery codes with the first second factor and plan for losing every factor.

How to check

Log in as a test staff member and as a test customer-organisation admin with only the password. Both are refused until the second factor is given. An authenticator app code is not accepted for staff. On the test copy, ten wrong codes in a row are slowed or blocked.

Sources

• NIST SP 800-63B-4 Authentication and Authenticator Management
• CISA fact sheet on implementing phishing-resistant MFA

Related rules

• Protect the accounts that can change the code in Engineering
• Keep the domain name yours in Website
• Slow down password guessing in Security testing
• Publish your packages without stored tokens in Security testing
• Sign people in through single sign-on in Infrastructure
• Hold every sign-in path to the same checks in Accounts
• Offer second factors from strongest to weakest in Accounts
• Confirm a second factor before turning it on in Accounts
• Ask everyone to keep two ways in in Accounts
• Let organisations require a second factor in Accounts
• Tell people when their password worked but the second factor failed in Accounts
• Give recovery codes with the first second factor in Accounts
• Plan for losing every factor in Accounts
• Use separate staff accounts in Accounts