Two-factor authentication: the first line of defence for accounts that touch grades, payments and payroll

A password is no longer enough

In most organisations, an account is protected by a single thing: its password. And passwords travel. They get written on a slip of paper under the keyboard, shared with a colleague "just for this week", reused on a personal email account, or typed into a computer at an internet café. Nobody needs to be a hacker to use one. They only need to have seen it once.

Two-factor authentication adds a second check that does not depend on the first. To get in, you need something you know (the password) and something you carry (your phone). Whoever read the password over someone's shoulder stays outside.

Why start with grades, payments and payroll

Not all accounts carry the same risk. An account that can only view a timetable exposes very little. An account that can change a grade, confirm a payment or alter a salary is another matter.

• Grades. A mark changed after the exam board has met alters a student's path and damages trust in the whole institution. Accounts belonging to lecturers, board secretaries and academic offices come first.
• Payments. A payment confirmed by mistake, a receipt issued with no money received, a refund sent to the wrong place: all of these happen from a cashier's or accountant's account.
• Payroll. Adding someone to the payroll, changing a bank account number or an amount takes a few clicks from an HR administrator's account.

In all three cases, the damage rarely comes from a sophisticated attack. It comes from a legitimate account used by the wrong person. That is exactly what two-factor authentication makes hard.

How it works in practice

The app on your phone

The most common method uses an authenticator app on the phone. Several exist, free of charge, for Android and iPhone. When you switch it on, the platform shows a QR code. You scan it once with the app, and the link is made.

From then on, each time you log in, the app shows a six-digit code that changes every thirty seconds. You type your password, then the code. That is all.

Two points matter a great deal here:

• the app works without mobile data or signal, because the code is generated on the phone itself. Running out of bundle or standing in a dead zone does not lock you out;
• it runs comfortably on an entry-level Android handset.

What about codes by SMS?

Some platforms send the code by text message. That is better than nothing, but weaker: SMS depends on the network, sometimes arrives late, and a SIM card can be replaced or taken over by someone else. When an app is offered, use the app.

Backup codes

When you switch the feature on, the platform also gives you a short list of backup codes, each usable once. They are for the day the phone is lost, stolen or simply stops working.

Write them down or print them, then store them the way you would store a safe key: not on the phone, not in an email. Without them, a lost phone means going through an administrator to restore access. That is normal, but it takes time, usually at the worst possible moment.

The objections we hear

"It slows people down." A few seconds per login. Many platforms can also remember a trusted computer for a set period, so the code is not requested every single time.

"Not all our staff have smartphones." Start with the people who hold sensitive rights. There are rarely many of them: a cashier, the payroll officer, an exam board secretary. The organisation can issue them a work phone.

"We trust each other here." Two-factor authentication protects honest staff too. It makes it far harder for someone else to act in their name, and when an operation is disputed, the login history becomes much more credible.

Where to begin

1. List every account that can change a grade, confirm a payment or touch payroll. The list is usually shorter than people expect.
2. Turn on two-factor authentication for those accounts first, with a few minutes of hands-on help for each user.
3. Have backup codes written down at the moment of activation, and check they are kept away from the phone.
4. Write down what happens when a phone is lost: who restores access, on what proof of identity, and how quickly.
5. Then extend it to other accounts, one department at a time.

A password proves that someone knows a secret; two-factor authentication proves they are the person who was meant to know it.

If you would like to review the sensitive accounts on your platforms, or help your teams build good habits, we run IT security awareness sessions on your premises, in French. Get in touch.