Picture this: It’s 7:00pm on a Friday and you should be enjoying the start to your weekend, but instead you’re answering a call from your team telling you that your company has been hacked. The message from the hackers reads something along the lines of: We have taken your systems hostage and will provide the decryption key to restore IT systems in exchange for $4.4 million.
Now imagine this single incident leads to a six-day shutdown which causes widespread gas shortages and panic buying across the entire U.S. Southeast and East Coast.
Sounds like a nightmare, right? It was.
In May 2021 this exact thing happened to the largest oil pipeline system in the US. An employee at Colonial Pipeline sat down expecting to log in to their computer and instead found themselves faced with a ransom note. By the end of that day, the company had completely shut down the oil pipeline that supplies nearly 45% of the fuel used on the East Coast. Americans rushed to the pumps, panic-buying gas out of fear that they wouldn’t be able to fill their tanks and gas stations from Virginia to Florida ran dry. This event was so significant that the President of the United States declared a state of emergency.
The company ultimately paid millions to these hackers to get its systems back and avoid further damage.
So, how did attackers get in?
This ransomware didn’t get into their systems through a sophisticated hack or a bad link in a phishing email. Instead, it came from the compromised employee password. But it wasn’t just the leaked password at fault in this case, the employee’s account lacked multifactor authentication, which allowed the hacker to gain access to the system without needing any form of secondary or identity authentication verification.
One compromised password is all it took to bring down critical infrastructure and disrupt millions of lives.
What Is Multifactor Authentication (MFA) and Why Does It Matter?
Multi-Factor Authentication (MFA) is an added layer of account security that requires two or more independent forms of verification instead of relying on simply password alone.
Think of it like a door with two locks.
First you have the handle lock (aka your password). It’s the lock everyone relies on, but it’s also the weakest link. Passwords get guessed, reused, phished, or leaked in data breaches, and once someone has your password that lock can be the victim of a brute force attack and busted through within a matter of minutes.
A secure door doesn’t just have one lock, it also has a deadbolt (aka your authentication method). This is something like a code sent to your phone or a fingerprint scan. Its job isn’t to replace the handle lock; it’s to provide a second layer of security when the first method is compromised.
Even if an attacker manages to break through your first layer of security, they’re going to have trouble breaking through the second layer of security because it’s much harder to break with mere force.
In the Digital Identity Guidelines (SP 800-63B), NIST breaks authentication down into three distinct categories:
- Something you know — a password or PIN
- Something you have — a security key or an authenticator app
- Something you are — a fingerprint or facial recognition
This separation matters because true multifactor authentication requires factors from different categories, not just multiple factors in general.
Entering a password (something you know) alongside a PIN (something you know) is still only single-factor authentication, since both rely on memory. Real MFA means pairing something from two different categories like a password (something you know) with a fingerprint (something you are) or a security key (something you have).
MFA closes one of the most commonly exploited gaps in account security. But it isn’t a silver bullet — it works best as one layer in a broader security strategy, not a replacement for one.
Building a Layered Security Strategy Around MFA
Though it’s a great starting point, a single MFA control isn’t enough to protect your business on its own. You need a layered security strategy that is fully implemented and regularly reviewed to ensure that your business is protected. A layered system can look something like the following:
Strong passwords & MFA: Complex passwords that combine uppercase and lowercase letters, numbers, and special characters are still necessary. While MFA is a strong secondary form of security for your account, there are several ways to bypass your secondary authentication such as flooding your phone with approval requests until you tap yes by mistake, stealing your live session cookies, or compromised SIMs. So just because you have back-up method doesn’t mean you can start using Password123! again.
Regular system updates and patching: Attackers frequently exploit flaws in outdated software. So keeping your operating systems, applications, and security tools current removes a significant amount of risk before it can be exploited.
Proper Security Awareness Training for employees: MFA protects against unauthorized logins, but it can’t stop human error from occurring. Ongoing training on phishing and social engineering tactics is what closes that gap.
Implement a backup system and recovery plan that is tested: Prepare for the worst case by ensuring your business has backups that are securely stored and regularly tested. Backups combined with a documented disaster recovery plan mean that any breach or system failure doesn’t become a nightmare and prevents permanent data loss.
Enact a Zero Trust policy: Zero Trust assumes breach is inevitable and, rather than trusting users or devices by default, it requires continuous verification and grants access strictly on a need-to-know basis. MFA is a core building block of this approach, but Zero Trust extends the principle to every access request, regardless of where it originates.
The Colonial Pipeline breach didn’t happen because of some sophisticated company breach, it happened because one basic control was missing from an employee account. That’s the uncomfortable truth behind most breaches: the tools to fix it were there all along, they just weren’t being used.
At Queen Consulting & Technologies, we help businesses close those gaps before they become a nightmare. Whether you’re implementing MFA for the first time, working toward CMMC compliance, or building a full layered security strategy, our team can assess where you stand today and build a roadmap to get your business where it needs to be.
Don’t wait for a Friday night phone call to find out where your security gaps are, reach out to QCT and let’s find them first.