Every day, my news and cybersecurity alert feeds bring reports of cyberattacks, including incidents affecting trucking companies. Sometimes these stories sound like spy movies: Government-backed hackers hunt for hidden flaws in a target’s software or equipment.

Often, though, the attack is far more ordinary. Someone gets hold of an employee’s username and password, then simply signs in as that person.

For a trucking fleet, that stolen login could open the door to email, financial records, dispatch systems, or telematics information.

That’s why one recommendation comes up again and again: Use multi-factor authentication, or MFA.

The advice is so common that, if cybersecurity incident reports were songs, MFA would be the chorus. But sometimes people sing along without knowing what the words mean.

So, what the truck is MFA — and how can it help protect your company?

What Is Multi-Factor Authentication?

Authentication is how a computer system checks that you are who you say you are. A password is one way to do that.

MFA requires proof from at least two different categories, known as authentication “factors”:

• Something you know, such as a password.
• Something you have, such as a security key or a phone with an authentication app.
• Something you are, such as a fingerprint or facial recognition.

You don’t need all three to use MFA. A password combined with a code from an authentication app is a common example.

The goal is to make a stolen password less useful. An attacker who knows your password still has another hurdle to clear.

Something You Know — Your Password

Think of a login screen as a sentry guarding a post in the dark. Someone approaches, gives a name, and supplies the password.

The sentry knows that person has the password. But is that really the person they claim to be?

A computer faces the same problem. Anyone with your username and password may be able to sign in as you.

That password could have been stolen through a fake login page, exposed in a data breach, or guessed because it was too simple. Reusing a password makes matters worse: A password stolen from one account may unlock another.

Something You Have — A Phone or Security Key

Our sentry needs another way to check the visitor’s identity.

In computer terms, that could be a physical security key, a device that generates a short-lived code, or an authentication app on your phone.

For example, after entering your password, you might need to enter a code from the app or approve a login request. Someone who steals your password would also need access to that second factor.

An unexpected approval request can also warn you that someone is trying to use your account.

Don’t approve a request for a login you didn’t initiate. Report it to your IT or cybersecurity contact. Attackers may send repeated requests, hoping you’ll eventually approve one just to make them stop.

Something You Are — Fingerprints and Facial Recognition

The third category uses physical characteristics, such as your fingerprint or face, to help verify your identity.

You may already use this when unlocking your phone.

In an MFA setup, a fingerprint or facial scan can work with a device you possess, such as a phone or security key. The scan helps confirm that the person using the device is its authorized user.

This doesn’t mean your fleet needs to install fingerprint readers everywhere. The right approach depends on the systems you use and the options they support.

Why Strong Passwords Still Matter

MFA adds protection, but it doesn’t make password security irrelevant.

Passwords have protected computer accounts for decades. You only have to watch the 1983 movie "WarGames" to see how long people have been looking for ways around them.

Over the years, many organizations responded by requiring complicated passwords and frequent changes. That sometimes led people to make predictable substitutions or recycle old passwords.

A better starting point is a long, unique password for each account. A passphrase — a longer combination of words — can be easier to remember without being easy to guess.

Avoid familiar quotations, company names, or personal details someone could find online. A password manager can help you create and store unique passwords.

Current guidance from the National Institute of Standards and Technology advises against requiring routine password changes simply because a certain amount of time has passed. Change a password when there is evidence it has been compromised.

And remember: Even a strong password can be stolen. That’s why another authentication factor matters.

Does Single Sign-On Replace MFA?

You may also hear about single sign-on, or SSO.

SSO lets you sign in once and access several approved applications without logging in separately to each one. For example, one company login might give you access to email and other business software.

That can make the workday easier and reduce the number of passwords employees must manage.

But SSO and MFA do different jobs. SSO simplifies access; MFA adds another identity check. A company can use both, requiring MFA when employees sign in through its central login system.

Because that login provides access to multiple applications, protecting it is especially important.

Bonus Round — Do Security Questions Count?

Here’s a quick test.

You log into an account with your username and password. Then you answer a security question, such as your mother’s maiden name or favorite sports team.

How many authentication factors did you use?

Only one: something you know.

You supplied two answers, but both came from the same category. Adding another question doesn’t turn a password-based login into MFA.

Where Should Trucking Fleets Start With MFA?

None of this requires you to become a cryptographer. Start by asking a few practical questions:

• Which accounts could cause the most damage if someone broke into them?
• Which can be accessed with only a username and password?
• How would we know if someone else were using those credentials?

Prioritize accounts that control other users’ access, remote connections to company systems, email, financial systems, and fleet telematics. Include your central SSO account if you use one.

Ask your IT team or service provider which MFA options those systems support. The method matters: Some forms of MFA can still be defeated by fake login pages or other tricks. The Cybersecurity and Infrastructure Security Agency recommends phishing-resistant MFA, such as appropriately configured security keys, wherever possible.

Employees also need to know what a legitimate login request looks like, what to do with an unexpected one, and whom to contact if they lose their phone or security key.

MFA is part of a broader cybersecurity strategy. Start with the accounts that would hurt the most, then work outward.

The next time an incident report recommends multi-factor authentication, you’ll know what the chorus means — and which questions to ask about your fleet.

About the Author: Ken Heskett is a cybersecurity engineer at the National Motor Freight Traffic Association. He collaborates with industry partners, academic institutions, and government agencies to strengthen cybersecurity practices and knowledge sharing across the transportation sector. He holds the Certified Information Security Auditor (CISA), Certified Internal Auditor (CIA), and Certified in Risk Management Assurance (CRMA) designations and is a regular presenter at cybersecurity conferences and a contributor to professional journals.

This article was authored and edited according to Heavy Duty Trucking’s editorial standards and style to provide useful information to our readers. Opinions expressed may not reflect those of HDT.