Module 4 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: multi-factor authentication and restricting administrative privileges explained for business owners, why ASD's Maturity Level Two attackers get around weak MFA with phishing and social engineering while Level Three attackers steal authentication token values to get around stronger methods, why phishing-resistant options such as passkeys and security keys behave differently, why admin accounts should never be used for email, and what evidence an insurer or assessor will ask to see.
Who Gets In, and What They Can Do
Two controls, one question
Two of the eight controls deal with people rather than software. Multi-factor authentication, and restricting administrative privileges. They answer the two questions every attacker has to solve: how do I get in, and once I am in, what can I do?
Patching, from the last module, is about closing holes in code. These two are about the front door and the keyring. Almost every serious incident we see in Perth businesses involves at least one of them, usually in the same order: a password gets stolen, the second factor was weak or missing, and the account that got taken over turned out to have far more power than anyone realised.
Proving it is really you with something beyond a password. It exists because passwords leak constantly, get reused across sites, and get typed into convincing fake login pages by sensible people on busy mornings. This is the control that keeps a stolen password from being enough.
Making sure the accounts that can change everything are few, deliberate, and not used for everyday work. This is the control that decides whether one compromised login is an annoying afternoon or the end of your business as it currently exists.
Good multi-factor authentication on an account that can do anything is still a single point of failure. Tight admin controls on accounts with no second factor are a locked cabinet in an unlocked building. ASD lists them separately because they are different jobs, but in practice you cannot get much value from one without the other.