The IT department at Midlands-based logistics firm Hargreaves Distribution marked a significant milestone this week, observing three full years since the team first agreed that two-factor authentication was probably something they should look into at some point.
The anniversary, which fell on Tuesday, was acknowledged during the weekly IT team meeting with what Head of Infrastructure Martin Kellaway described as “a genuine sense of how time does rather get away from you.”
Two-factor authentication, a security measure that has been considered standard practice across most sectors since approximately 2015, was first raised as a potential project during a particularly ambitious phase in early 2022, when the department had briefly entertained the notion of being proactive about security rather than simply waiting for something terrible to happen.
“We’re actually very close now,” Kellaway explained, gesturing towards a substantial ring binder labelled ‘Feasibility Study: Phase Two’. “The initial feasibility study took about fourteen months, which some might say is thorough. Then we had to commission a second feasibility study to check whether the first one had been feasible, which is just good governance.”
The project has successfully navigated numerous hurdles over its three-year journey, including two changes in leadership, a brief period when everyone thought someone else was dealing with it, and an extended consultation period to determine whether the company’s 200 employees could reasonably be expected to cope with the additional four seconds of login time.
“Next quarter is looking very promising,” Kellaway added, a phrase that appears verbatim in meeting minutes dating back to September 2022. “We’ve nearly finished mapping out the user journey, and once we’ve done that, we’ll need to form a working group to decide which authentication app to recommend. There are at least three or four options, apparently.”
Jennifer Okonkwo, the company’s sole cybersecurity specialist who was hired eight months ago and has since developed a slight twitch in her left eye, confirmed that the implementation could theoretically be completed in an afternoon.
“I’ve mentioned this,” she said, speaking quietly whilst staring at a point roughly three feet above the interviewer’s head. “Several times. I’ve sent emails. I’ve created a presentation. I’ve offered to just do it myself whilst everyone goes for lunch. But apparently we need to consider the cultural change management implications and whether this is really the right time given everything else that’s going on.”
Everything else that’s going on is understood to include one person being on annual leave and a general sense that it’s probably fine for now.
The IT department has scheduled a review meeting for next quarter to discuss whether the fourth anniversary might be an appropriate target for beginning the pilot programme, assuming the budget allows and provided nothing more urgent comes up.