There are terms that pop up in almost every cybersecurity advisory, yet many people only have a superficial understanding of what they actually mean. The following three concepts are among the most basic, yet most effective, defense tools.
MFA – one key is not enough
MFA (Multi-Factor Authentication) means that logging in requires more than just one thing – typically your password – but also at least one other, independent confirmation, such as a code sent to your phone or a number displayed in an authenticator app. The point is that if someone gets your password (for example, from a data breach), they won’t be able to log in with that alone, because the second factor is missing. It’s like locking a safe with not only a key but also a second code that only you have – a burglar would need both.
Backup – the safety net
The essence of backup is that a copy of important data is regularly made and stored in another location, separate from the main system. If a ransomware virus encrypts it or a hardware failure destroys the original data, it can be restored from the backup without having to pay a ransom or losing the data permanently. According to the “3-2-1 rule” often recommended by experts, it is worth making three copies, storing them on two different media, and keeping at least one copy completely isolated from the network. However, a backup is only worth something if you try to restore it from time to time – an untested backup is just an assumption, not a guarantee.
Encryption – data made unreadable
During encryption, data is converted into a form that can only be read back with the appropriate key using a mathematical process. If an encrypted data carrier – such as a laptop or a pendrive – falls into unauthorized hands, the information stored on it will be practically useless to the acquirer without the key. Encryption applies not only to stored data (at rest), but also to internet traffic: when a website address starts with “https”, it means that the communication between the browser and the server takes place over an encrypted channel.
These three measures alone significantly reduce the chance and consequences of a successful attack – and their combined application provides one of the most important pillars of cybersecurity fundamentals for every business, regardless of size.