If you do one thing to secure your information

Recently, I was working with a freelancer and needed to share a bunch of documents with them. When I asked him where to send the documents, he gave me his personal gmail account address.

Ok, using a personal account is not ideal, I thought, but that’s fine. It’s a totally common practice for vendors working with small and even large enterprise companies to use their personal accounts for getting access to documents.

But to be extra secure, I asked the freelancer if he had two-factor authentication (2FA) turned on for his personal account.

“Huh? Do I have what turned on? How do I do that?”

I was shocked - how could he not be protecting his own and his customer’s documents and information? Every client working with this freelancer is one password dump away from having every shared document exposed.

We’ve all heard about how important 2FA is. But many folks still haven’t taken the leap yet. Turning on 2FA is the simplest action you can take to prevent account takeovers and information leaks.

I’ll be blunt.

Turning on 2FA for your entire organization is the simplest and largest security gap that you can close. Out of all the security gaps that we see across companies, nothing else reduces as much risk with so little effort.

It might be boring and cliche but it works.

Where should I turn 2FA on?
At a minimum, get all your communication, infrastructure, and document tools like Google, Slack, Apple, GitHub, Microsoft, Amazon, Facebook, and Twitter. These are what cause the most damage when they’re compromised.

What’s the best option for 2FA?
You have three options for 2FA. Text, email or authenticator apps. We recommend using authenticator apps, they’re more secure.

That said, having any 2FA is way better than not having 2FA at all. If you need to give ground here and use text or email 2FA, that’s okay. The important thing is that you get it turned on, regardless of the exact method.

Are the physical keys (hardware) worth it?
They do make a difference and are worth setting up for sensitive data or infrastructure. If your IT team is pushing for them, it’s a good idea to set them up. YubiKey is one of the more popular options.

Again, don’t let these hold you back though. If you’re setting up 2FA for the first time, get 2FA enabled regardless of how it’s set up. You can always upgrade to physical keys later.

Should I worry about personal accounts?
Yes, a lot of folks miss this.

Many of us know to force 2FA on our work accounts. But if any personal account gets compromised, it’s not hard to fake the identity of that employee and start getting access to company accounts.

This is harder to mandate across your team but it’s absolutely worth it, especially for roles that have sensitive access.

Are there any step-by-step guides that I can forward to someone on my team?
Google has put together a fantastic mini website all about 2FA here.
Microsoft has a brief overview of how to set up 2FA for your Microsoft account.

If there’s only one thing you do for security this year, turn 2FA on for all the core services you use at work and personally. And make sure your contractors, freelancers, and vendors do too.

It’s the simplest way to make progress on your security goals, and will save you from potentially big security issues some point down the road.

Is there anything preventing you from getting 2FA enabled for your team?

Copyright © 2022 Up Advisors, LLC., All rights reserved.
You received this email because you signed up to get emails from Product Habits.

Our mailing address is:

Up Advisors, LLC.

13337 South St. #269

Cerritos, California 90623

Add us to your address book

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list

If you do one thing to secure your information

Older messages

I should have known

The people worth investing in

How work is changing

An untapped goldmine for customer research

How Stripe scaled

You Might Also Like

Youre Overthinking It

eBook: Software Supply Chain Security for Dummies

The 5 biggest AI prompting mistakes

An interactive tour of Go 1.24

Spyglass Dispatch: Bromo Sapiens

The $1.9M client

⚙️ Federal data centers

Post from Syncfusion Blogs on 01/15/2025

The Sequence Engineering #469: Llama.cpp is The Framework for High Performce LLM Inference

3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update