Buy now
Blog

2fa in the company

Why two-factor authentication also makes sense for companies

User accounts and passwords have had their day when it comes to protecting sensitive data. In payment transactions and for many online services, double security via two-factor authentication has long been standard. However, stricter data protection regulations and increased home office remote access mean that proof of identity using 2FA is also becoming more and more important for corporate networks.

A password is often all that stands between hackers and sensitive company data. The user name can usually be easily guessed from personal data, and lax handling of passwords as well as social engineering or brute force attacks quickly open the door to attackers. Two-factor authentication promises double security. This procedure uses another recognition method in addition to the user name and password.

Two-factor authentication in payment transactions

Electronic payment transactions not only involve highly sensitive data, but also a lot of money. The highest security standards should be a matter of course here. That’s why the Payment Services Directive2 (PSD2) has forced many companies to implement two-factor authentication (2FA for short) since 2021. This affects all companies that make online payments. This includes not only banks, but also fintechs, payment service providers, Internet stores or online providers of accounting software. Here, a second security feature is now mandatory for electronic payments. In the future, two of these three factors will therefore be required for a payment:

  • Knowledge: for example, a password or PIN
  • Possession: such as a bank card or smartphone
  • Biometrics: fingerprint or facial recognition

For banking transactions, these requirements are implemented with chipTAN and Sm@rt-TAN using special TAN generators. These devices generate a TAN for transactions supported by the bank card and meet high security requirements. The photoTAN and SecureGo processes, on the other hand, allow smartphone apps to be used for TAN generation. Although an additional device is not absolutely necessary here, the smartphone is also easier to compromise – for example, via the Android banking malware “Cerberus”.

In a completely analogous manner, web services rely on two-factor authentication to secure log-in with a one-time password that is only valid for a single use and is usually time-limited based on the current time (time-based one-time password, or TOTP for short). The one-time passwords used here can also be generated on the smartphone or – and much more securely here – via additional hardware such as an authenticator for secure two-factor authentication with TOTP. This technology makes phishing attacks and attacks with keyloggers more difficult and in many companies already secures access to office packages such as Microsoft 365 or remote maintenance tools such as TeamViewer. However, 2FA and TOTP are also techniques that can be used in a company’s own network.

Data protection requirements and recommendations

The data protection regulations, which have become much stricter in recent years, are the main reason for securing the company network with two-factor authentication using time-limited one-time passwords (TOTP). The EU General Data Protection Regulation (EU-DSGVO), for example, obliges companies to also take into account the state of the art when processing sensitive data. The EU GDPR formulates this requirement in Article 32 on “security of processing”:

"Taking into account the state of the art, (...) the controller and processor shall take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk."

In its “Handout on the state of the art,” the Federal IT Security Association e. V. recommends two-factor authentication for hardening server systems. Otherwise, companies would have to ensure the use of strong uniform password guidelines for user passwords (such as password length, complexity, lock counter, change cycle, etc.). The German Federal Office for Information Security (BSI) goes one step further with its recommendations for protecting user accounts: The authority, which is based at the Ministry of the Interior, summarizes all the details on authentication procedures in the ORP.4 Identity and Authorization Management module of the IT-Grundschutz Compendium and in its implementation notes. According to this, companies should fundamentally consider whether passwords should still be used as the sole authentication method at all. Especially for user accounts with far-reaching authorizations, the BSI recommends strong authentication with at least two authentication features, for example, a password and an additional time-limited one-time password (TOTP).

If data theft of personal data occurs, companies not only face reputational losses, but also fines of up to 20 million euros or four percent of annual turnover. In the event of a case, affected organizations would have to prove that they have complied with the provisions of the EU GDPR and secured the data with an appropriate level of protection. Whether simple user accounts and passwords still provide an adequate level of protection is already questionable in many cases in light of the BSI recommendations.

The two-factor authentication in the enterprise

Strong authentication in a company’s own network is particularly necessary when employees have access to internal, security-critical data or applications and the confidentiality or integrity of sensitive data would be jeopardized by identity theft. This applies in principle to insurance companies and many government agencies, but also to financial service providers, educational institutions, and medical facilities, hospitals, and other companies in the healthcare industry. Companies in industry and commerce are also affected, as are medical practices, lawyers and auditors, who must ensure that their patient and client data is adequately protected.

If colleagues in the home office or field staff access business-critical company data and applications via a virtual private network (VPN), these accesses should also receive the best protection. In fact, the risks of identity theft are particularly high here. In the home office, just 42 percent of organizations use company IT exclusively, but employees’ private PCs are generally much easier to compromise. Companies should therefore rely on double security here as well and ensure VPN connections and two-factor authentication. According to the BSI, however, only around half of all German companies have made use of this so far.

If companies move their data and applications from their own network or data center to the cloud, the issue of secure access becomes even more important. Larger companies usually have an eye on securing their hybrid cloud environments. However, with Software as a Service (SaaS) such as Microsoft 365, which provides employees with office and productivity tools or other business applications for their daily work, the situation is often still different. These cloud applications are also used in many smaller companies, where security awareness is not yet quite as pronounced. Often, the applications are then used via standard log-in, although a large proportion of SaaS services also support secure two-factor authentication with TOTP.

More convenience thanks to two-factor authentication
It is important for companies to sensitize employees to IT and information security and to involve them in the implementation of new security measures. This also applies to the company-wide introduction of two-factor authentication. Of course, logging in with an additional factor initially requires a bit more effort. However, uniform, hardware-based end devices for generating the time-limited one-time passwords not only increase security – compared to software-based 2FA solutions – but also make it easier for IT to support employees. Additional convenience for IT and all employees, especially in hybrid cloud environments, is provided by the introduction of an identity and access management (IAM) system that brings together all accesses and resources. Such IAM solutions, which are now also available cloud-based, make it much easier for IT admins to manage user identities and access rights. But they also enable employees, service providers and partners to access the system easily via single sign-on (SSO). Users then only need to enter their credentials once to access all corporate data and applications in the cloud or behind the firewall of the corporate network. This gain in convenience not only increases productivity, but also the acceptance of double security via two-factor authentication.

More contributions