we switched to two-factor authentication but employees are writing down their passwords, and there's no second factor

employees resist, normal and we made a training video and made it mandatory within 1 week. we disabled the sysetm for anyone who didnt complete it.

sms 2fa is simple but a phishing target (interceptable)... authenticator apps are better, google authenticator or ms authenticator works too

edit: fixed a few typos.

did you apply 2FA to the admin panel? if admins can bypass 2FA for everyone, all security goes down the drain.

create backup codes (10-15), keep the first ones with admins, employees keep the rest. if phone is lost, show backup code to admin.

don't restrict mobile, not worth it. employees should be able to log in from home laptop with 2FA too.

We experienced almost the exact same thing last year. People defend habits not processes. Resistance comes from there.

Correct me if Im wrong.

I'm writing this so you don't make the same mistake. The harder it is to reverse a decision the slower you should make it.

If I were you I'd go this route.

I completely agree. Don't rely on a single measure; go layer by layer.

Hope this helps.

I'm curious too.

There's one point I'm curious about. Most incidents start with a leaked password, not a vulnerability.

Of course, it varies if your situation is different.

We experienced almost the exact same thing last year. Payment information changes are never verified through the channel they came from.

This is my opinion, I'm not claiming it's absolute truth.

Sorry, but this doesn't apply in every case. When making a decision, first look at what data you have on hand.

If you have questions, write them; I'll answer as best I can.

I completely agree. People defend habits, not processes. Resistance comes from there.

When making a decision, first look at what data you have on hand. I'm also curious if anyone does it differently.

saved. anyway an untested bacup is not a backup.

I have an objection here. The real issue isn't the number, but what it's based on.

If you post the result here, it will help others too.

I went through the same thing.

I feel the same way... Start with a small trial; dont commit to everything at once.

If you post the result here it will help others too.

The discussion got scattered, let me summarize. If you get three different answers on a topic, the question was asked wrong.

If you post the result here, it will help others too.