Professional IT support
Our proactive IT support team relates to the challenges faced by other businesses and offers our own unique approach to help optimise your IT infrastructure and workflows. If you need helpdesk IT support, network management, cloud solutions, cybersecurity expertise, or strategic IT consulting, connect with us.
Learn more ->IT Support
Outsourced IT Support Packages & Pricing Remote IT Support Proactive IT Support Apple IT Support Switching Providers Pricing Estimator
Fully managed IT services
IT is at the heart of every business. Make sure it’s managed reliably and professionally.
Learn more ->
Cyber Security services
IT is at the heart of every business. Make sure it’s managed reliably and professionally.
Learn more ->Featured Posts
Secure IT Asset Disposition
Read more ->
What Is App Fatigue & Why Is It a Security Issue?
Read more ->Frequently Asked Questions
Here you can find a comprehensive collection of helpful answers to the questions we are most frequently asked, designed to provide quick and clear guidance on our services and how we work.
Learn more ->Featured Posts
Best Ways to Use ChatGPT at Your Business (Without Things Getting Out of Hand)
Read more ->
Avoiding AI Data Leakage
Read more ->Our Vision
Our vision is to make the organisations we partner with the very best they can be.
Learn more ->Featured Posts
Is a managed service agreement right for my business?
Read more ->
What is included in a Managed Service Plan?
Read more ->Request free IT audit
The Shift to Phishing-Resistant MFA
Beyond the Text Message
For years, Multi-Factor Authentication (MFA) has been the cornerstone of digital security. However, as cybercriminals evolve, older methods are failing. Specifically, the common practice of sending six-digit codes via SMS is now considered a significant risk. For organisations handling sensitive data, SMS-based MFA is no longer sufficient.
The Fatal Flaws of SMS MFA
While better than a password alone, SMS was never designed for secure authentication. It is vulnerable to several sophisticated attack vectors:
- SIM Swapping: Scammers use social engineering to trick mobile carriers into porting your phone number to a SIM card in their possession. They then receive all your MFA codes, allowing them to reset your passwords and hijack your accounts.
- SS7 Vulnerabilities: Hackers can exploit flaws in global telecommunications protocols to intercept text messages without ever touching your physical device.
- Real-Time Phishing: If a user enters an SMS code into a fraudulent login page, attackers can capture it instantly and use it to log in before the code expires.
The New Gold Standard: Phishing-Resistant MFA
To stay secure, businesses must adopt authentication that removes the human element from the process.
1. Hardware Security Keys
Physical devices (such as YubiKeys) are the most robust defence. They perform a cryptographic "handshake" with the service. Because there are no codes to type and the key must be physically present, remote attackers are completely blocked.
2. Passkeys and FIDO2
Passkeys use public-key cryptography to link a specific device to a domain. They are "phishing-resistant" because the device will only release the credential if the domain matches the official record. They often use biometrics (Fingerprint or Face ID) for ease of use.
3. Authenticator Apps with Number Matching
If hardware keys aren't feasible, apps like Microsoft or Google Authenticator are a significant step up from SMS. To prevent "MFA Fatigue"—where users blindly tap "approve" on repeated push notifications—modern apps now require "number matching", where the user must type a code displayed on the login screen into the app.
Strategic Implementation
Transitioning away from SMS requires a shift in company culture. Users appreciate the familiarity of text messages, so it is vital to explain the risks of SIM swapping and the value of the data being protected.
- Priority Enrolment: Phishing-resistant MFA should be mandatory for all privileged accounts, including administrators and senior executives.
- Phased Rollout: Introduce authenticator apps or passkeys to the wider workforce in stages to allow IT support to manage the transition effectively.
Authenticator Apps with Number Matching
If hardware keys aren't feasible, apps like Microsoft or Google Authenticator are a significant step up from SMS. To prevent "MFA Fatigue"—where users blindly tap "approve" on repeated push notifications—modern apps now require "number matching", where the user must type a code displayed on the login screen into the app.
The Cost of Inaction
Relying on legacy MFA provides a false sense of security. Upgrading to modern identity solutions offers one of the highest returns on investment in cybersecurity, as the cost of hardware keys is negligible compared to the fallout of a data breach. Is your business ready to move beyond passwords and text codes? We specialise in deploying modern identity solutions that safeguard your data without frustrating your team. Contact us today to secure your authentication strategy.
Get support tailored to your company's specific requirements!
Our mission is to provide technology guidance, expertise and support to enable our customers to grow their business.
Start Here
Sign up to receive useful information regarding your IT without the fluff
By Subscribing you are agreeing to receive our IT updates newsletter released each Month. You will not receive anything else.
