A password alone is one secret that can be guessed, reused or stolen. Multi-factor authentication, often called two-step verification, asks for something more before it lets a person in.
This article explains the kinds of method, where firms usually go wrong and what to check before you turn it on. It gives no promise that any method makes an account safe.
The problem
Email, the case management system and the document store hold what clients told you in confidence. One stolen password can open all of it if nothing else is checked at sign-in.
Many firms turn on a second step for some accounts and forget the rest, or choose a method that a fake sign-in page can defeat.
What is known
We found no independent figure on how much multi-factor authentication lowers a law firm's risk that we could verify, so we give none.
What security agencies describe is that the methods differ in strength. A code sent by text message or voice call, and an approval tap in an app, can be tricked by a fake page that asks for them. Hardware security keys and passkeys that follow the FIDO and WebAuthn standards are designed to resist that.
Agencies also describe a weakness called prompt fatigue, where an attacker sends approval requests again and again until someone taps yes. Some systems answer it by asking the person to type a number shown on the sign-in screen.
What to do
- List the systems that hold client information or control money: email, case management, document storage, billing, the bank portal, remote access and every administrator console
- Turn it on for everyone in those systems, starting with email and administrators, and allow no exceptions for partners or senior staff
- Choose the strongest method each system supports, and prefer a security key or a passkey where the firm can manage them
- Give every person their own account, because a shared login cannot tell you who signed in
- Write a recovery plan: a second method for each person, who may reset access and how that person proves who they are
- Keep recovery codes offline, in a safe place, and not in the mailbox they protect
- Tell staff what to do with a prompt they did not start: do not approve it, and report it the same day
Common mistakes
- Protecting email but not the case management system, the bank portal or remote access
- Leaving old sign-in routes open, such as app passwords or legacy protocols that skip the second step
- Letting a phone call to the help desk reset access without a real check of who is calling
- Making a text message code the only choice for everyone, when stronger methods are available
- Saving recovery codes in the same email account they are meant to protect
- Forgetting vendors, outside consultants and temporary staff who have accounts in the firm's systems
- Turning it on without telling staff why, so they approve every prompt to make it stop
What to look for when you implement it
- Which methods each system offers, and whether the firm can require one method for all users
- What happens when a person loses a phone or a key, and how long recovery takes in practice
- Whether a new employee gets set up on the first day, and whether a departing employee loses access the same day
- Whether administrators can see who has the second step turned on and who does not
- Test the sign-in and the recovery path with a spare account before you require it for everyone
- Ask your attorney whether any contract, insurance policy or client agreement asks the firm to use it