How do you handle MFA for remote and mobile workers?

It is crucial to analyze your risk profile, considering the criticality of data, regulatory standards and the threat scenario. Sensitive information, such as medical records and financial transactions, requires more robust layers of security, while less strategic data may require more flexible protections.

Pick an MFA that is: * Easy to use * Strong enough to protect your data * Works on different devices * Affordable * Flexible for different situations and contexts * Clearly explained to employees

Risk profile and risk appetite are key to identify what are the necessary controls and respective tech to be in place. In regards to authentication, MFA and 2FA are good options to implement a defense-in-depth approach. Identity is now the perimeter. Relying on a single mechanism to authenticate (i.e. username and password), specially in heavily regulated industries such finance, is no longer an option and 2FA/MFA becomes a must.

I wouldn’t say it’s totally in affective… it depends on exactly the type of multi factor. Is it just sms, token , push notification… remember best practices… never a guarantee… but chance favors the prepared… we do know however… not having it… is clearly a recipe for disaster…

For remote and mobile workers, set up MFA that’s flexible but secure. Use app-based authentication, like Okta Verify or Google Authenticator, so they can access codes on their phones even without network access. Adaptive MFA is also helpful, adjusting requirements based on location or device risk. This way, known devices may get quicker access, while new ones go through extra verification. It keeps things secure without making access too complicated for users on the go.

SMS codes: Easy to use and accessible, but vulnerable to interception and SIM swapping. Email codes: Convenient for users but can be compromised if email accounts are hacked. Push notifications: Secure and user-friendly but may require an internet connection. Biometrics: Highly secure and convenient, though may struggle in low-light or noisy environments. Hardware tokens: Very secure, yet prone to being lost or stolen.

SMS should no longer be used due to its low reliability, high usability and low security, not all places can have biometrics, easy recognition too, perhaps using authentication without a password is a better option, or using it in a way that adapts to each situation.

I would recommend MFA with a conditional access policy. That way if anyone tries to access a resource outside the corporate network, will be challenged by MFA.

MFA must be imposed, and when an identity is high risk, an additional layer must be added for each login, and for users detected as self-risk, or login risk and requiring a password change, this must be rotating.

A strong MFA policy for remote workers requires layers of security. Enforce MFA for all remote access, but leverage risk-based factors. High-risk applications require strong MFA while lower-risk applications allow simpler authentication methods . To ease logins, pre-registered devices on trusted company networks can bypass MFA for routine access. Finally, you can mandate enrollment of all authorized devices and consider geo-restrictions for added security.

We must have continuous training, and carry out several simulations to identify the weak point, and always continue with training, the greatest vulnerability will always be the end user, it is not always the system that is weak with the use of social engineering.

In my experience, as IT and security professionals we tend to live in a bubble of sorts. Most people (most of the end-users we're trying to protect via MFA) aren't up-to-date of the latest security best practices and the data breaches that hit last week. They just see a new, annoying hoop they have to jump through in order to go about their day-to-day lives and jobs. And it's well-documented that between convenience and security, the average person chooses convenience. It's our job to help people understand not just *how* to enable and use MFA, but *why*. Put yourself in their shoes, and build a "curriculum" that takes an empathetic approach to educating and training.

As I said, in addition to implementing MFA, you must impose MFA and password change for those identities with login errors, failures and anomalies. Monitoring and detection are essential to keep everything in order.

Monitor and Evaluate: Regularly assess MFA performance using metrics and user feedback to identify issues and improve security. User Familiarity: Implement MFA methods that are familiar to users, such as fingerprint scanning on smartphones, to promote adoption. Contextual Authentication: Use contextual factors like time, location, and IP address to adapt authentication requirements for remote workers. Passwordless Authentication: Implement passwordless authentication methods to reduce friction and improve security for remote workers. Remote Support: Provide remote support services to assist users in setting up and troubleshooting MFA, ensuring minimal disruption to work.