Are you doing everything you can to protect your client data?

Nigel Ogram

Let’s face it – it’s first thing in the morning. You’ve made your strong coffee, but you’re still a bit bleary-eyed. As you start work for the day, logging into your PC and all your various apps is a bit of a chore – all those passwords to remember… It’s tempting to make it easy on yourself by using the same simple password for your accounts. It’s also tempting to remove a step from the process by skipping two-factor authentication.

Success! You have indeed made it easier for yourself, but you’ve also just made it massively easier for someone to hack your account.

Now I’ll be the first to admit that some accounts warrant less protection than others. Your login credentials for  ‘UKRAS’ – the Roundabout Appreciation Society possibly don’t need as much protection as your online banking credentials…

While we’re thinking about online banking, I think we’d all agree that two-factor authentication (2FA) is an absolute necessity. Passwords, passcodes, passkeys, facial recognition – anything to protect your money, right? So why aren’t you applying the same high levels of security to your client’s information? After all, the information contained within your Genovo account is a hacker’s dream. Personal details (some of it potentially classed as ‘sensitive’), assets & liabilities, plan details, valuations, policy numbers. Hackers would (and do) pay a small fortune for this kind of data. Can you imagine what your clients would think if they knew you weren’t taking all reasonable steps to protect their data, just so that you can save ten seconds logging in every morning?

According to Microsoft, accounts protected with multi-factor authentication are 99% less likely to be compromised than those protected by a password alone.

And this isn’t just a problem for “other people”. High-profile attacks on organisations including Uber and Reddit began with compromised credentials and weaknesses in authentication processes.

Scarily, only 40% of UK businesses (and staggeringly, only one third of charities) routinely use 2FA. For cybercriminals, that’s an open invitation. If you’re one of the 40%, well done and you can stop reading here!

If you’re one of the 60%, there’s some good news. Enabling two-factor authentication on your Genovo account takes just seconds and costs nothing, but it adds a powerful extra layer of protection between your account and the bad guys. It also allows you to reassure your clients that you and your colleagues treat their information security as though it were your own.

Is data protection via 2FA a Company issue?

Your company’s data security is only as strong as its weakest link – if a hacker decides to target you, they will find your weakest link – they are consummate experts at it. If your Genovo account has (say) ten users and nine of them have enabled 2FA and one hasn’t, then we would argue that the account is only marginally more secure than if nobody used 2FA. Think of it as home security – you’ve locked your front door and your side door but left your patio doors unlocked. Do you think a burglar will give up after trying only the front door?

Ultimately, we believe a company’s data security needs to be addressed by the company, not left to individual choices.

Some more good news, if you’re an Account Owner or Account Admin of a multi-user Genovo account, you can take control yourself and enforce 2FA for all Genovo users for your company. Ultimately this is company data that requires company protection.

Will Genovo mandate 2FA?

Along with many other software providers, we feel so strongly about the security of your clients’ data that we are seriously considering mandating 2FA for all Genovo users. We will give plenty of notice, but in the meantime, we would genuinely be interested to hear your thoughts about this. Please get in touch to let us know your feelings.

While we ponder the pros (lots) and cons (few) of mandating 2FA, we thought it would be useful to remind you of the 2FA options in your Genovo account.

Options if you’re an account owner / account admin

1) Mandating 2FA

Account Owners or admins can mandate 2FA for all their account’s users via Account admin > Account settings simply by toggling the ‘Mandate two-factor authentication‘ button.

Once ‘Mandate 2FA’ is activated, any user who does not already have 2FA activated for their account will be prompted to activate 2FA for their account (via email or an authenticator app) the next time they log in to Genovo.

2) Temporarily disabling 2FA

Sometimes, life and technology conspire against you. You have 2FA by authenticator app and your phone battery dies. You have 2FA by email and your email server goes down. As an Account Owner, or Account Admin, you can temporarily suspend 2FA for a user. This allows them to get into their Genovo account, but they will be required to set up 2FA again when they next log in (perhaps using the alternative authentication method if they still don’t have access to the original authentication method). This process is covered in depth in this article in the Genovo Knowledge Base.

Setting 2FA for your own Genovo account

If your firm does not currently mandate 2FA on your Genovo account, this doesn’t stop you from setting it up for yourself. It really couldn’t be much simpler – simply log into your Genovo account, go to Account admin, 2FA and then select one of the 2FA methods (email or authenticator app – we recommend the latter, as its near-instant, whereas a 2FA email can take a minute or two to arrive). 12 seconds from start to finish!

IMPORTANT! Regardless of whether you set up 2FA yourself or if your company has mandated it, as part of the setup process, you’ll also be given a set of recovery codes:

These codes enable you to get into your Genovo account if you don’t have access to your authentication method. Save them somewhere safe – really safe!

If you’ve lost access to your usual 2FA method (lost your phone, don’t have access to your email, etc), you can click on the ‘I don’t have access to my 2FA device’ link and it will ask you for one of your recovery codes. Once you’ve used a recovery code, it can’t be re-used, so you should delete it or mark it as ‘used’.

Once 2FA is set up on your account, after the usual username and password page, you’ll then get a 2FA page, where you enter the six digit code from your authenticator app, or from your 2FA email:

Nigel’s knowledge

I usually link to a few other Genovo Knowledge Base articles here on the same subject as the blog, but they’ve all been covered within the blog.

Instead, here’s another thought about information security. It’s all very well setting high standards for your own security for the various apps and systems used in your advice firm, but all your measures can be rendered worthless if the app provider doesn’t take security just as seriously. Do you know the security standards of the providers of all your software? Arguably, it’s all part of the regular due diligence you should undertake when choosing a software partner. At Genovo, we are extremely serious about data security and we’re justifiably proud of our ISO 27001 certification (we’re very recently re-certified). It takes huge effort and commitment to achieve and maintain our certification, but that’s a measure of the importance we place on the safety of yours (and your clients’) data.

Finally – a bit of free advice! Get a password manager app. They can be transformational. Massively secure (and unique) passwords, auto-fill options, 2FA code generators and critically, no writing down of credentials…

You’ll find loads more really useful information in:

• Genovo’s series of User Tip blogs;
• the extensive Genovo Knowledge Base;
• the collection of really useful Genovo matrices;
• the ever popular Genovo video tutorials;

Of course, if you’re still stuck, or just need a helping hand, you can always submit a support ticket and we’ll get straight back to you.

Finally – make sure you don’t miss any of our hints & tips – subscribe and get email alerts when we update our blog.

Share this post

< Back to latest news