Cybersecurity Awareness Month: Multi-factor authentication.

The fourth and final Cybersecurity Awareness Month theme from the Digital Trust Hub is Multi-Factor Authentication, built on a practical routine: Set Up. Check. Report.

Earlier this month, the resources focused on recognizing phishing and giving every account its own password. Even with both habits in place, a password can still be stolen. Multi-factor authentication (MFA) adds a second layer of protection, so a stolen password alone is not enough to sign in. As this week’s flyer puts it, a layered defense is the best defense.

This week’s resources help employees understand how MFA protects their accounts, why some sign-in methods are stronger than others and how to respond to a sign-in prompt they didn’t expect.

For staff

• A staff email template that explains how MFA works, why passkeys and security keys are the strongest sign-in methods and how to respond to repeated prompts or requests for a code, in Word and Google Docs formats
• A flyer for staff spaces, newsletters and digital displays, with messaging that works all year

Each district adds its own help desk information, approved MFA method and any enrollment deadline to the staff email, and keeps the setup link that matches its platform. Before sharing it, a district confirms that the backup methods, number matching and passkey guidance reflect how it has configured sign-in.

For the technology department

MFA protects an account only when it covers the accounts that matter and can’t be bypassed through account recovery. Passkeys add stronger protection because they work only on the real site they were created for. That means they resist fake sign-in pages and fake help desk requests, which can still defeat text codes and push prompts.

• SOP: Setting Up and Managing Passkeys, a suggested procedure for moving from passwords and basic MFA to phishing-resistant sign-in, for districts ready to take that step

Make sure the promise holds

The staff email and flyer tell employees that technology staff will never ask for their MFA code. This week’s action for technology departments is to confirm that help desk practices match:

• Verify identity before resetting a password or re-registering a sign-in method.
• Never ask an employee to read back a code, approve a sign-in prompt or register a passkey on another person’s device, including during troubleshooting.
• Tell staff how to contact the help desk directly when they want to confirm that a request is genuine.

When employees know what the help desk will and won’t ask, a scammer’s request stands out.

This theme closes this year’s Cybersecurity Awareness Month resources.