Security Fundamentals

Cybersecurity Awareness Month, week 1: Check who has MFA on your business email

NetworkDefender Security

← Back to Blog

October is Cybersecurity Awareness Month. Throughout the month, NetworkDefender will share one practical security action each week for small businesses. Each post will focus on something you can work through with your employees or IT provider and confirm when it is complete.

This week, start with your business email. Ask the person who manages it to confirm which employee accounts are covered by a requirement for multifactor authentication, including your own, and identify any gaps.

Why start with email?

Your inbox contains conversations that help your business run. Depending on your work, those messages may include client documents, invoices, payment instructions, and links to other business systems.

If someone gains access to an employee's account, they can use that access to impersonate the employee and send requests that appear to come from a trusted contact. The FBI's Internet Crime Complaint Center describes compromised business email accounts as part of schemes involving fraudulent transfers.

Multifactor authentication, or MFA, adds another way to verify who is signing in. You may already use an authenticator app or security key. A stolen password alone is less useful when the account also requires that additional verification. CISA recommends MFA for business accounts, including email.

For this week's action, keep the scope manageable and start with the accounts people use to access your company's email.

Check coverage across the business

Seeing an authentication prompt on your own account tells you something about your account. It does not tell you whether the same protection applies to everyone else.

Someone may have joined after the initial setup, or an account may have been excluded from a policy while an issue was being resolved. Those are possibilities to check during the review.

There is also a difference between registering an authentication method and having a policy that requires its use. An employee having an authenticator app on their phone is only part of the answer.

Ask your IT provider or email administrator to review the current user list and confirm:

  • Every employee who accesses business email is covered, including owners and part-time staff.
  • Employees have completed the required authentication setup.
  • Any exclusions have a documented reason and a person responsible for reviewing them.
  • Accounts with missing protection have a specific next step and completion date.

Have the administrator review privileged and emergency access accounts separately so their protection and recovery arrangements are handled appropriately.

Let your administrator verify the settings

You can initiate this review without knowing your way around an admin portal. Ask for a short account-by-account summary and an explanation of how the protection is being enforced.

For Microsoft 365, one detail matters: the older per-user MFA status does not tell the whole story. Microsoft explains that an account can show as "Disabled" on that screen while MFA is enforced through Conditional Access. Security defaults are another way Microsoft provides MFA protection. Your administrator needs to check the applicable policies and exclusions, rather than relying on that single status column. Microsoft's documentation explains the distinction.

Work with employees on any changes so they understand how to sign in and who to contact if they lose access to their authentication method.

If everyone is already covered

Keep the review date and results, then ask which authentication methods your business allows. CISA recommends phishing-resistant MFA, including FIDO2 security keys, because some other methods can still be tricked by phishing attacks.

That can inform a future improvement. This week's task is to establish who is covered and address any missing protection.

Your action for this week

Send this question to whoever manages your business email:

"Can you confirm which of our employee email accounts are covered by an MFA requirement, including mine? Please list any exceptions and what we need to do to address them."

By the end of the week, aim to have a reviewed account list, confirmation of the protection in place, and an owner and completion date for any remaining work.

Next week, we will cover a backup restore test so you can check whether an important file can be recovered when you need it.

Sources

Get Security Updates in Your Inbox

Practical cybersecurity guidance for Wisconsin small businesses: new threats, compliance changes, and what to actually do about them. No spam, unsubscribe anytime.