For those claiming MFA doesn't impact organizational productivity, stop looking at it from your view. Look at it from the organization's view. People lose MFA tokens and can't log in. People have to change MFA devices (new phone, new token, etc). Helpdesk handles "issues." 1/n
Only infosec would claim that this has no impact. Doctors don't give diabetics news that they'll have to test blood sugar followed by "it's just a prick after every meal, so it won't have any impact." When we make claims that are OBVIOUSLY false, this lowers our credibility. 2/n
Feel free to say "the productivity impacts of MFA are insignificant compared to the benefits." BTW, I personally believe this. But I believed in the Easter bunny too. I have anecdotal evidence for both. At most, only one of them is real. 3/n
So I ask again "where's our data?" I have lots of people putting words in my mouth and a few downplaying the impacts of implementing MFA (again, without any data). But data always outweighs feelings. If nobody has data, shouldn't we get some? 4/n
I can't think of another profession where we make recommendations as if they're gospel when what we really mean is "we're pretty sure this is the right thing for us to do." I can't believe so many in our industry fail to see this. 5/n
Nobody says to management "adopt this manufacturing process and things will be rosy" without data to support that claim. It's hard to believe we don't have data. Its much harder to believe that professionals in our industry are arguing that data isn't needed at all. 6/6
