2FA in 5 Minutes: Why a Password Alone Is No Longer Enough

A good password is an important start, but it's no longer enough. Passwords leak from websites that have been hacked, get stolen through phishing messages that look completely genuine, and are often reused across several places. Once someone has your password, there's nothing left to stop them.

That's where two-factor authentication (2FA) comes in. At Oz-Tal we recommend it to every client, and for good reason: it's one of the simplest and most cost-effective steps in information security.

What it actually is

Two-factor authentication adds a second step to your password: a code from an app on your phone, a tap to approve, or a physical security key. Even if someone has your password, they can't get in without the second step. The logic is simple: the password is something you know, and the second step is something you have in your hand. An attacker sitting somewhere else will find it very hard to get both. For the user it usually adds just a few seconds at login, and the system often remembers a familiar device.

Where it matters most

Email. Your mailbox is the key to everything else. It's where passwords get reset, invoices arrive and client correspondence happens. Anyone who gets into an office mailbox can also send messages in your name that look completely genuine. In Microsoft 365 and Google Workspace, 2FA can be turned on for every user in the organisation.

Remote access. Do people work from home or connect to the office from outside? Every door that opens to the internet is also a door attackers try to open. Remote access, VPN or any other external access should require a second step.

Terminal servers. In many offices all the work happens on a central server that everyone connects to. If that server is exposed to the internet with only a password, one user with a weak password can put the whole office at risk. Here too, 2FA can and should be added.

Systems with sensitive information. Accounting software, school systems and donor databases. Anywhere that holds information about people.

A few common mistakes

• Turning it on only for the manager. Attackers look for the weakest account, not necessarily the most important one. Turn it on for every user.
• Relying only on SMS. A text-message code is better than nothing, but an authenticator app or a physical key is more secure.
• Approving every prompt that pops up. If you get an approval request on your phone and you weren't trying to log in, don't approve it. It's a sign that someone else has your password, and you should change it right away.

Why "5 minutes"?

Because for most users, that's genuinely how long it takes: install an app, scan a code and confirm. The real work is on the organisation's side: choosing the right method, setting a policy for all users, covering servers and remote connections, and having a proper way to restore access when someone changes their phone. That's the part we do for you.

We'll set it up for you

At Oz-Tal we'll go through every entry point in your organisation with you, set up 2FA on email, remote access and servers, and give your staff a short, simple explanation. Call us on 02-500-2022 (Sun–Thu, 09:00–16:00) to book a time.