cybersecurity

3030 readers

2 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Be kind
Limit promotional activities
Non-cybersecurity posts should be redirected to other communities within infosec.pub.

Enjoy!

founded 1 year ago

MODERATORS

[email protected]

Passwords and 2FA at a small business (self.cybersecurity)

submitted 7 months ago by FriedSink to c/[email protected]

18 comments fedilink hide all child comments

It seems there are two options when it comes to passwords: 1) SSO 2) DIY with a password manager and 2FA ideally with a security key.

SSO is too pricey ($1500 base @ Okta) at the moment and SAAS prices are ever increasing so that leaves us with option 2. Using an authenticator app means using personal phones, which is tricky, and if someone were to lose their phone the replacement cost would be high. So a security key seems better in that regard despite their upfront cost. Plus security keys like yubikey offer the ability to store TOTPs, which is necessary since not all the apps we use provide security keys as a 2FA option.

Did I arrive at the right conclusion on 2FA with security keys or did I miss something?

The other consideration is deployment. Without interrupting workflow, I figured the best way would be to set up all the keys (backup key as well for each employee) on a Friday after work and then 2-day ship them to our remote staff so they're ready for use when they return to work on Monday. It's possible we could also do it while they're on a week-long vacation to save on shipping costs.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 7 months ago (1 children)

If you are a business that uses 2factor you should expect to have your employees expense their phone bills as you are using a private resource. You may need to provide the phone as well. If you are willing to pay this it's probably the most secure form of account security.

Otherwise go with an oath service. If you have less than 6 users it will be significantly cheaper.

[–] FriedSink 1 points 7 months ago

Will it be cheaper? If Okta is an oauth service they have $1500 as their base price. Unless they're the exception