a What to do ™@ Manage and audit the use of each authentication factor. @ Physically separate authentication profiles in the IT system. So even if an attacker finds out a user’s password, it will not lead him to the user’s biometric or physical token profile. H Configure all accounts such that a user gets access only if he has every authentication factor right. Users must not share physical tokens. This ensures that every one is accountable. Biometric information must be well protected as, unlike passwords, it cannot be changed once stolen. If you want to do more —™ Create a central authentication solution that enforces and manages all multifactor authentication services for the business. Good rules to have @ if any physical token is lost, it must be disabled immediately. H@ Track all tokens and biometric profiles and ensure they are properly stored and processed.