The question: what should a small office require for multi-factor authentication on remote access, and how do you roll it out to non-technical staff without a week of lockouts? I do this for a few nonprofits, and I have a lean, but I would like to hear where others have landed.
My lean on what to require: anything that lets someone reach the internal network or a desktop from outside gets MFA, no exceptions for the director. VPN, remote desktop gateway, and the admin pages of anything exposed. Email too, but that is its own topic. An app-based code or a push prompt is my floor. SMS is better than nothing, and I would still rather not build a plan around it.
The rollout is where it goes wrong, and it is almost never the technology. It is the person who gets a new phone on a Saturday. What I have settled on:
- Enroll people in person or on a call, one at a time, with the phone in their hand. Fifteen minutes each. Mailing instructions to six people produces six different problems.
- Have every user register a second method, or give them backup codes on paper in a sealed envelope. Yes, paper. It is the cheapest recovery path there is.
- Turn it on for two volunteers first, wait a week, fix what surprised you, then do the rest.
- Name one person who can reset a user, and write down how they confirm it is really the user asking. A reset process that accepts a friendly email is a hole in the door.
- Keep one break-glass admin account with its own stored recovery method, kept out of daily use, in the binder or a safe.
What I am less sure about is hardware keys. They are the best answer on paper, but the cost in time and lost keys is real for a staff of six, and I have not run them at that scale.
What do you require on remote access at your small shops, and what has actually caused your lockouts? Phones, travel, or something I have not thought of?
Dwayne