Over the past two weeks, we've covered how attackers get in: phishing, deepfakes, ransomware, and what to do when they do. Access control is about the layer that decides whether any of that actually works: even a perfectly crafted phishing email or a stolen password is useless to an attacker if the account behind it is properly protected. Today we look at the single most effective access control measure available, where it still falls short, and what's changing.
The single most impactful step you can take
Multi-factor authentication (MFA) remains the single most impactful step available for securing digital accounts. It requires more than one of three categories of proof before granting access:
- Something you know: a password, PIN, or security question
- Something you have: a smartphone, hardware security key, or smart card
- Something you are: a fingerprint, face scan, or voice
Combining at least two of these creates a significantly stronger barrier than a password alone: research suggests MFA can prevent upwards of 89% of cyber breaches. It protects email, cloud storage, remote access and VPN connections, and privileged admin accounts alike.
A real lesson in why this matters: the Bromcom SSO breach
Bromcom, a widely-used school management system, suffered a breach of its legacy single sign-on (SSO) registration component. The leaked data: staff and pupil email addresses, SSO provider details, sign-in dates, didn't include passwords or authentication tokens, and no MIS data was directly accessed. But it created a verified, ready-made target list of school email addresses linked to specific SSO providers: ideal material for a follow-on phishing campaign.
The real lesson isn't the leaked data itself, it's that SSO concentrates risk. If one set of credentials unlocks your MIS, your cloud storage, and your email, then the account behind that single sign-on absolutely must be protected by MFA. An attacker with a phished password still can't get in if MFA is enabled; without it, those exposed addresses become exactly the target list an attacker needs.
Where traditional MFA still falls short: MFA bombing
Even MFA isn't immune to abuse. MFA bombing (also called push bombing or MFA fatigue) is where an attacker who already has a stolen password repeatedly triggers push notification prompts, hoping the user gets frustrated or confused and approves one by mistake, sometimes while impersonating support staff to talk the victim into approving it. It's a reminder that traditional MFA methods are a major improvement over passwords alone, but they're not unbreakable, and they rely on the user making the right call under pressure.
What's changed: the NCSC now recommends passkeys
This is a genuine, recent shift worth knowing about. As of CYBERUK 2026, the NCSC now actively recommends passkeys wherever a service supports them, and two-step verification where it doesn't; a stronger position than their previous, more cautious stance.
What are passkeys? Rather than a password you type, a passkey is a cryptographic credential: a public key held by the service, and a private key stored securely on your device, unlocked by your fingerprint, face, or device PIN. Apple, Google and Microsoft have all adopted the standard.
Why the NCSC has moved on this: their assessment found that traditional MFA methods, including the push notifications behind MFA bombing, are "inherently phishable," while passkeys cryptographically bind authentication to the legitimate service, making them immune to phishing, credential stuffing, and brute-force attacks entirely. There's no password to steal, no push notification to spam, and no shared secret to leak in a breach like Bromcom's.
Passkeys aren't a magic fix for everything, the NCSC notes that good implementation still depends on device security, clear account recovery options, and realistic rather than perfect rollout. But the direction of travel is now clear enough that it's worth planning for, not just something to keep an eye on.
Personal and School Social Media Accounts
Access control isn't just about school systems, personal and school-branded social media accounts are now the most commonly reported cyber crime in the UK, and a lucrative one: stolen sums from email and social media hacking rose 417% in 2025/26, from £1.2 million to £6.3 million. Attackers who take over an account typically impersonate the owner to defraud their contacts, including, for a school's own social media accounts, parents and the wider community.
A few additions worth applying to both staff personal accounts and your school's official social media profiles:
- Switch to passkeys where the platform offers them, and enable two-step verification everywhere else, the same shift covered above
- Lock down privacy settings so posts and personal details are visible only to trusted contacts, not the public
- Avoid oversharing exploitable details: birthdays, locations, pet names. The same information often used as security question answers
- Verify before you trust a message, even from an account that looks right, if a "parent" or "colleague" messages asking for something unusual through social media, confirm it through a separate channel first, exactly as covered in Days 6 and 7
If an account is compromised, report it to Report Fraud (0300 123 2040, or Police Scotland on 101 for Scottish residents), and follow the NCSC's account recovery guidance.
💡Your Daily Cyber Tip
Enable MFA on your primary cloud storage services — Google Drive, Dropbox, OneDrive, iCloud — right now. It takes about five minutes per account. If your school already offers passkeys on Microsoft 365 or Google Workspace, this is a good moment to start moving toward them, account by account, starting with admin and finance accounts.
Where this sits in the DfE Digital & Technology Standards
Setting up MFA directly fulfils the Cyber Security standard's expectations; schools are expected to meet these standards by 2030. Given the NCSC's updated position, it's worth asking your IT provider whether passkey support is on their roadmap for your Microsoft 365 or Google Workspace tenancy.