Multi-Factor Authentication on Cloud Accounts
Not all second factors are equal, and team accounts need an approach that survives one person losing a phone.
Multi-factor authentication is the single highest-value control on a cloud account, because it defeats the most common failure: a password that has been reused, guessed or leaked.
The options, in order of strength
SMS codes
Better than nothing and widely supported. Vulnerable to SIM-swapping, where an attacker persuades a carrier to move the number. Acceptable for low-value accounts; not ideal for anything holding infrastructure.
Authenticator applications
Time-based codes generated on a device. No carrier involved, works offline, and supported nearly everywhere. This is the sensible default for most teams.
Hardware security keys
A physical device using public-key cryptography. The strongest widely available option, and the only one that resists phishing properly, because the key checks the site’s identity before responding.
For an account controlling production infrastructure, hardware keys are worth the modest cost.
The team problem
Personal MFA is straightforward. Shared administrative accounts are where teams get into trouble, because the second factor lives on one person’s phone and that person eventually goes on holiday, changes device, or leaves.
Workable approaches:
- Enrol more than one device where the provider allows multiple factors.
- Store recovery codes in the team password manager, treating them as credentials.
- Give each person their own identity with their own factor, and reserve the shared root credential for genuine emergencies.
That last option is the right long-term answer. Individual identities mean individual factors and an audit trail, as discussed in least-privilege access.
Recovery codes are credentials
Recovery codes bypass the second factor by design. Stored in a chat message or an unencrypted note they undo the protection entirely. Store them where you store passwords, and regenerate them if anyone who had access leaves.
After a handover
Confirming that MFA is enabled is not sufficient. Remove existing factors and enrol your own, because a factor registered to someone else is equivalent to them still having the password. This is step two of the first hour after taking over a cloud account.
Cloud accounts on OldCloudShop
Ten providers, every configuration and the starting price for each.
Continue in the library
Other entries covering account structure, billing, security and provider infrastructure.