At a food company with around one hundred and forty computers, production staff are not allowed to use their personal phones during a shift. When the idea came up of extending multi-factor authentication to PC logins, the employees’ objection was already known: the company asks them to leave their private phone in the locker and then expects it to be used to log in to the computer. A second factor was already active on Microsoft accounts. For workstations, the IT department had given up on the second factor to avoid complaints.
The same plant had about sixty users enabled for VPN access, authorised case by case by department heads without any written company rule. An intrusion had once started from a user account. The requirement to comply with NIS2 put the issue back on the management agenda.
Which accesses should multi-factor authentication cover first?
Cloud accounts that give access to email, files and Microsoft 365 applications, then the VPN and administrative accounts; workstation logins can follow later.
Cloud accounts can be reached from anywhere on the internet, and a stolen password is enough to get in. At a healthcare organisation with several sites, the initial analysis found many employee credentials online, in clear text or easy to decrypt. On those accounts a second factor prevents access by anyone who knows only the password.
The VPN comes next, because it opens the internal network. Administrative accounts complete the first round: domain, firewall, backup consoles. There are few of them, but their misuse compromises everything else. Extending the second factor to workstations creates more operational friction, and it is best assessed role by role, starting with staff who handle the most sensitive data.
Article 21 of the NIS2 Directive lists the use of multi-factor authentication among cybersecurity risk-management measures, where appropriate. For companies outside its direct scope the request often comes from customers, as described in the article on NIS2 compliance in the supply chain.
A security questionnaire and a VPN granted over the phone
The manufacturing group with assembly lines and around fifty users, the same one whose NIS2 compliance journey we described in October, had just completed the 98-question self-assessment. No second factor was active on any access. The VPN served five to ten occasional users and was granted with a phone call, even in the evening, with no written record. The IT contact saw multi-factor authentication as almost a detail, and feared the reaction of users who already struggled to change their domain password.
Aesir proposed enabling the second factor first on Microsoft 365 identities, the most exposed surface, then on the firewall VPN and administrative accounts. The IT contact considered extending it to every domain login too intrusive. In its place, the project introduced a tool that temporarily removes administrative privileges and restores them only after approval through an external application.
Production users kept logging in to the domain as before, with no extra codes. Email, files and VPN received the second factor straight away, while every administrator operation now goes through a recorded approval. The company could thus answer customers’ security questions with documented evidence on both points.
Insight. At this company the fear of complaints concerned the daily login on the shop floor, which was not the most exposed access. Separating the two problems made it possible to protect email, VPN and administrators at once, and to postpone workstations to a later phase with timing and roles already decided.
How can multi-factor authentication work without a company phone?
With physical security keys for staff who do not want to use their personal phone or work where phones are not allowed, starting with the most exposed roles.
A security key plugs into the computer or is held near the phone, and confirms the login without any code to type. The same device can double as an access badge and integrate with the VPN. On shared workstations, such as production departments or a customer service desk, the certificate on the key leaves a trace of who used the terminal. Keys are bought by the company, one per person, and the partner registers and configures them; before extending them, it is worth testing two or three in the field.
The most frequent objection concerns loss. If the key is also needed to enter the building, nobody leaves it at home twice. Where phones are banned, the answer for the remaining cases is a spare key held by the IT department, or a temporary access code issued by IT on the cloud identity, valid until replacement. On local infrastructure the certificate of the lost key is revoked. Every exception goes through the IT department or the partner’s service desk, following a written procedure.
Employees need to know when the code is requested, normally at the first login from a new device. In projects run by Aesir, the comparison with a banking app, which everybody already uses, works well. Roll-out proceeds by group: management and administration first, then the departments, with short recorded training for shift workers.
The food company described at the start chose this path. Its IT department will extend multi-factor authentication to critical users within the following year, according to a written roadmap, while production departments stay out of the first phase.
Administrator credentials open everything else
A compromised administrative account can disable protections, delete backups and create new users. Credentials with privileges are therefore stored and tracked separately, through privileged access management, or PAM. It covers administrators, technical and service accounts, and the credentials for firewalls, backup and directory services.
The first step of PAM often concerns passwords kept in the wrong places. In an administration office the passwords for online portals sat in a text document, a spreadsheet and a few scraps of paper. The pilot project started from the department with the most sensitive passwords, which moved into a digital vault with a long master password, a periodic second factor and expiring shares. On the firewall, every change made by an administrator requires a justification, which is recorded. Protection of the documents themselves, beyond the accounts that open them, is covered in the article on corporate document protection.
Remote sites go through the firewall
Branches connect to headquarters through encrypted tunnels between firewalls, while mobile staff use a personal VPN with multi-factor authentication. Separate networks for users, guests and servers limit the damage of unauthorised access. At the food plant the VPN is blocked from abroad and accepts only Italian addresses. The IT department asked HR and department heads to take formal responsibility for every new authorisation.
Multi-factor authentication in four phases
| Phase | Access | Method | Starting with |
|---|---|---|---|
| 1 | Cloud accounts: email, files, applications | Authenticator app or security key | Management and administration |
| 2 | VPN and remote access | Second factor on the firewall, country and time filters | Staff working off-site |
| 3 | Administrative and service accounts | Credential vault, time-limited privileges | IT department and external suppliers |
| 4 | Workstation logins | Security key or certificate | Exposed roles and shared workstations |
Before extending the second factor, it is worth checking:
- the inventory of accounts, including shared administrative accounts and service accounts;
- the list of VPN users, with the name of whoever authorised each one;
- employees without a company phone and workstations where phones are not allowed;
- the procedure for lost keys, spare keys and temporary codes;
- the message to employees, stating when the code will be requested;
- retention of administrative access logs, for a defined period;
- the evidence to keep for customer questionnaires and for NIS2.
The same rules we apply to our own access
Aesir Srl operates as an MSP and MSSP within the same contractual scope, through its Operations & Security business unit: second factor and access controls are part of the managed service, together with monitoring and incident response. Aesir is a Fortinet partner for firewalls and VPNs, holds ISO 9001, 27001, 27017 and 27018 certifications and is voluntarily aligned with NIS2. Internally the same rules apply: multi-factor authentication on every account and a protected VPN to the proprietary Tier IV data centres in the European Union.
Objections from the office
Is the code requested at every login?
Usually not. The code is needed at the first login from a new device or at intervals set by the company, for example every twelve hours for a password vault.
What is the difference between IAM and PAM?
IAM governs the identities and access of all users, including the second factor and joiner and leaver procedures. PAM protects accounts with administrative privileges, storing their credentials and tracking their use; both are needed, because they cover different risks.
Is a text message a sufficient second factor?
It remains a fallback, useful during roll-out. Authenticator apps and physical keys offer stronger protection against account theft and SIM swapping.
Does NIS2 require multi-factor authentication?
Article 21 of the Directive lists it among risk-management measures, to be adopted where appropriate. For many companies outside its direct scope the request still arrives through customer questionnaires.
Let’s talk
Multi-factor authentication meets less resistance when it starts from the most exposed accesses and reaches workstations last, with an alternative ready for staff who do not want to use their personal phone. If you would like to explore the subject or assess the situation in your own company, you can fill in the form at the bottom of this page or write to support@aesir-tech.it: we will arrange a free consultation and start from your numbers.