I posted this is a response to another thread but the topic might be missed as it was inquiry if it will impact parents. This is a more general concern.
In addition to the Blackbaud's BB ID, they announced they will be enforcing Two-Factor Authentication (2FA) (MFA) for users with elevated access to their systems.
The 2FA requires the end user to have a mobile device, where Blackbaud 2FA provider will send a text or require to use a 2FA app. While we applaud Blackbaud steps in taking security seriously, What does this mean for organizations that do not provide mobile devices to their employees? What does it mean for organizations that do not endorse or advocate the use of personal devices for their employees? If an organization does, do they have have a policy in place? If so, is the organization accounting for renumeration, compliance, and monitoring of personal devices?
Because Blackbaud's 2FA does not offer other established alternatives such as allowing the organization enforce 2FA with their native soltuion (my org does this), offer a phone call 2FA solution or 2FA security keys, this seems to create two issues.
1) Incuring additional (hidden) costs to the organization (e.g. providing organization owned mobile devices, renumeration for personal devices, AMM software, etc.)
2) If endorsing personal devices, there is a perception of deminished Privacy for employees and boundries between work life expectations.
When we tested Blackbaud's 2FA it is an added layer to our existing 2FA authentication. This is disappointing. If other options were avaialble it would avoid the above issues. While security is on the forefront of their mind, why isn't cost and privacy? Did anyone in this community conclude the same or have a different perspective? #compliance #work #privacy #security #MFA
