Two-Factor Authentication enabled in KeyPay
There's no hiding the fact we live in a highly digitised world. Whilst this provides us many luxuries not afforded to past generations, it's apparent that it has also resulted in increased digital crime, identity theft and internet fraud. Now I don't mean to scare people but we need to accept that this is reality. Bearing all that in mind and to further enhance the security of your data, KeyPay has enabled Two-Factor Authentication (2FA). This will be available to all users from 29 May 2018.
What is Two-Factor Authentication?
Put simply, Two-Factor Authentication is an extra layer of security that is known as "multi factor authentication". It requires not only a username and password but also something that only that user has on them, i.e. a piece of information only they should know or have immediately to hand - such as a physical token.
How does Two-Factor Authentication work?
Currently, when logging into KeyPay you are asked to enter your email address and password. Once 2FA is enabled and you log in for the first time, you will be asked to enter a verification code. This temporary code will be sent to you either via email or sms (depending on your settings). You will only be able to continue once you have entered the correct verification code.
When you attempt to login using a new device for the first time, you will need to undertake the 2FA process and enter the verification code sent to you. By entering the code, you are verifying that the new device is to be trusted. It's all part of the extra security folks!
Also note: logins and 2FA are cookie based, so if you delete cookies as part of clearing your browser cache or history then you will need to undertake the 2FA process again.
How do I enable Two-Factor Authentication?
2FA can be enabled at four different levels, as follows:
- Branded payroll.
Employees & Users
Employees and Business Users (both full access or restricted users) can choose to enable 2FA for their account. This is possible to do even if it is not enforced at a Business or Branded Payroll level.
To access the setup, click on 'My Account' on the top right hand side:
You will then see a section dedicated to 2FA:
To enable 2FA, you need to:
- confirm your email address (you will receive an email and will be required to click on the link); and/or
- add your mobile phone (you will then receive a confirmation code via text that must be entered).
You can choose to confirm only one of the above, however we strongly recommend you confirm both options. It also goes without saying that your email address and mobile number should be kept up to date in KeyPay at all times!
A Business can choose to enforce 2FA on all of its full access users. Once enabled, a full access user will not be able to login to KeyPay without having undergone the 2FA process.
To configure this setting, go to Payroll Settings > Manage Users and click on the "Manage Two-Factor Authentication" tab:
Upon selecting "Require two-factor authentication for full access users", a second setting will appear with the option of enforcing 2FA when submitting super batches via our ClickSuper integration.
A Branded Payroll Manager can choose to enforce 2FA on all Businesses set up under their Branded Payroll. To configure this setting, go to Branded Payroll settings > Security and click on the "Manage Two-Factor Authentication" tab:
Once enabled, all Businesses associated with the Branded Payroll will automatically be required to undergo 2FA for all its full access users. Please note that this setting can be disabled at an individual Business level.
Strengthened Password Security
As part of our spruced up security shakeup, we have tightened the controls around setting up passwords.
When a user sets up a password for the first time or resets their password, they will notice a scale determining the strength of their password, as follows:
A user will not be able to save a password classified as either Weak or Normal. As a minimum, the password must be classified as Medium.