Recommended Free Tools
The highest-value IAM changes are to require multifactor authentication (MFA), make phishing-resistant FIDO/WebAuthn the preferred method, minimize standing privilege, harden recovery and authenticator enrollment, alert on sensitive account changes, and set session lifetime by risk. These controls make takeover and fraudulent recovery harder; they cannot guarantee that an account will never be compromised.
IAM guidance combines organization-wide policy with settings exposed in an individual service. A company can enforce role-based access, separate administrator accounts, and session policy centrally, while an end user may only be able to register an authenticator, save recovery codes, or turn on security alerts. A particular service might not provide every control described here.
As an Amazon Associate I earn from qualifying purchases.
Set the priorities in the right order
Start where one stolen identity would cause the most damage: administrator accounts, corporate email, remote-access systems, and applications containing sensitive information. Then extend the same baseline to ordinary users. The sequence below follows the risk reduction available from the controls and the practical dependencies between them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Priority | Setting | Why it matters | Main qualification |
|---|---|---|---|
| 1 | MFA with phishing resistance | Blocks many password-only attacks and makes credential phishing substantially harder. | FIDO/WebAuthn is the target; weaker methods are fallbacks, not equivalents. |
| 2 | Least privilege and role-based access | Limits what a compromised account can change or access. | Permissions must be reviewed as jobs and systems change. |
| 3 | Recovery and authenticator-change protection | Prevents an attacker from bypassing MFA by taking over the reset or enrollment path. | Recovery choices differ by service and assurance level. |
| 4 | Risk-based session expiry | Reduces the time a stolen session token remains useful. | There is no universal correct timeout. |
| 5 | Unique passwords and a password manager | Stops password reuse from turning one breach into many account compromises. | Frequent forced rotation is not a substitute for MFA. |
CISA’s administrator guidance and MFA guidance provide the organizational baseline, while NIST SP 800-63B-4 describes requirements and options for covered digital identity services: CISA IAM best practices, CISA’s MFA guidance, and NIST SP 800-63B-4.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Require MFA, with phishing resistance as the target
Enable MFA first for administrators, email, remote access, and systems holding sensitive data. Expand it to every other account as the service supports enrollment. MFA adds a second factor to the password, but the factor’s resistance to phishing matters: an attacker can relay or capture some codes while a user is being deceived.
Prefer FIDO security keys and WebAuthn passkeys
Physical security keys and FIDO/WebAuthn authenticators bind the login to the legitimate site, which is why CISA describes them as phishing-resistant. They can be USB, NFC, or another supported form factor; compatibility depends on the identity provider, browser, operating system, and device. Register at least two authenticators when the service permits it, and keep the spare in a separate secure location so loss of one device does not force a weak recovery process.
When purchasing a key, verify that the target service supports the relevant FIDO/WebAuthn mode and that the user’s devices have a compatible port or wireless interface. No single model is universally supported, and price or availability is not established by the guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use number matching only as an interim push control
Ordinary push approvals can be abused through repeated unsolicited prompts, sometimes called prompt bombing. If phishing-resistant authentication is unavailable, number matching—requiring the user to enter a number shown on the sign-in screen—is a more defensible interim choice than an uncontextualized approval tap. Users should deny unexpected prompts and report them rather than approving one to make the notifications stop.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Treat one-time codes as fallback protection
Authenticator-app codes, hardware-token codes, SMS codes, and email codes can still prevent a password-only compromise, but they are not phishing-resistant by themselves. CISA states: “One-time passwords, whether generated in an app or hardware token or delivered through SMS, e-mail, or some other out-of-band method, do not protect against phishing unless they are combined with some other phishing-resistant technology such as mutual TLS authentication.” Read that statement in context: OTP remains useful for adding a factor, but a phishing site can capture and replay it.
| MFA method | Phishing resistance | Operational considerations | Best use |
|---|---|---|---|
| FIDO/WebAuthn security key or passkey | Phishing-resistant | Requires service and device support; plan a spare authenticator and recovery route. | Preferred for administrators, email, remote access, and sensitive systems. |
| Number-matched push | Improved over blind approval, but not the target resistance level | Depends on a phone and the push service; users must check the sign-in context. | Interim control when FIDO/WebAuthn is unavailable. |
| Authenticator-app OTP | Not phishing-resistant by itself | Requires enrollment and a safe backup; codes can be relayed. | Fallback or transitional MFA. |
| SMS or email OTP | Not phishing-resistant by itself | Depends on control of a phone number or inbox, both of which may be targeted. | Last-resort fallback, not an equal replacement for a security key. |
Keep privileged access narrow
Use least privilege and role-based access control so each identity receives only the permissions required for its work. CISA recommends limiting who can administer systems, defining roles with explicit permissions, and removing unnecessary accounts. A compromised everyday account should not automatically be able to create users, change security policy, read all mail, or alter backups.
Separate administrator and everyday identities
Where feasible, give each administrator a normal account for email and routine browsing and a separate administrative account for privileged work. Require MFA on both, but make the privileged account subject to stricter reauthentication and session policy. Do not use a shared administrator login: it prevents reliable attribution and makes offboarding difficult.
Review privilege instead of granting it permanently
Inventory accounts, roles, group membership, and delegated permissions. Remove dormant accounts and access that no longer matches a person’s job. Schedule reviews after role changes, acquisitions, or major application changes. CISA’s communications-infrastructure hardening guidance also emphasizes controlling administrative access as part of reducing the impact of a stolen credential: CISA communications infrastructure hardening guidance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make account recovery robust and observable
Recovery is part of the authentication boundary. If an attacker can reset a password, replace an authenticator, or persuade support to bypass checks, strong login MFA may not matter. Do not make an easily compromised email inbox or phone number the sole recovery route for a high-value account.
Know the recovery methods NIST describes
NIST SP 800-63B-4 identifies saved recovery codes, codes issued during recovery, recovery contacts, and repeated identity proofing as possible methods. For accounts operating at Authentication Assurance Level 2 (AAL2), the standard calls for qualifying combinations such as two recovery codes from different methods, one recovery code plus an already-bound single-factor authenticator, or repeated identity proofing where available.
| Recovery option | How to use it safely | Important limit |
|---|---|---|
| Saved recovery codes | Generate them once, store them offline or in a protected password manager, and mark each code as used. | Anyone who obtains the codes may be able to recover the account. |
| Issued recovery codes | Accept a newly issued code only through the provider’s verified recovery flow. | The provider may use a different process or not offer this option. |
| Recovery contact | Choose a contact whose account is separately protected with strong MFA and whose identity is known to the organization. | A compromised contact can become a takeover bridge. |
| Repeated identity proofing | Use the provider’s documented proofing process when other authenticators are unavailable. | Availability and evidence requirements vary by service. |
These are NIST requirements and options for covered digital identity services, not a universal consumer-account recipe. Consumer services can implement different combinations. Whatever the method, keep more than one authenticator bound where possible so normal access does not depend on emergency recovery.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Require and monitor recovery notifications
NIST states: “An account recovery event always causes one or more notifications to be sent to the subscriber to help detect the fraudulent use of account recovery.” Turn on every available alert for recovery, password reset, new-device sign-in, and security-setting changes. Treat an unexpected recovery message as an incident: use a known-good device to sign in, revoke unfamiliar sessions, inspect authenticators and contacts, and contact the provider through its official support path.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect authenticator enrollment and security-setting changes
Adding a new authenticator is as sensitive as changing a password. An attacker with a stolen session may try to register their own key, phone, or app and then remove the victim’s devices. Require recent reauthentication before enrollment or removal, and require an existing strong authenticator whenever the service supports that policy.
Give users a review checklist
- Open the account’s security page and list every registered device, key, passkey, and authenticator.
- Remove devices that are lost, sold, retired, or unfamiliar.
- Verify recovery contacts and phone numbers, including who controls them.
- Enable alerts for authenticator enrollment, recovery, password changes, and new sessions.
- After a suspected compromise, revoke active sessions and rotate affected credentials before re-enrolling devices.
NIST documents secure binding processes and encourages maintaining multiple authenticators. The exact menu names and alert controls are service-dependent; the standard does not establish that every provider exposes each one.
Set session expiry according to risk
Session cookies and tokens can let an attacker act without repeating the password or MFA challenge. Limit token duration and require reauthentication when a session expires, as CISA recommends. Choose the duration according to role, device context, data sensitivity, and operational needs rather than applying a universal number of minutes.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Context | Session policy direction | Trade-off to check |
|---|---|---|
| Privileged administration | Shorter sessions, frequent reauthentication, and reauthentication before sensitive changes. | More interruptions during maintenance; use approved managed devices to reduce friction. |
| Remote access to internal systems | Short lifetime and prompt reauthentication after inactivity or network changes. | Help-desk volume may increase if travel or connectivity is unpredictable. |
| High-value data applications | Expire sessions on a risk signal and before exporting or changing security settings. | Balance protection against workflows that require long-running tasks. |
| Low-risk routine use | Longer persistence may be acceptable on managed devices with screen lock. | Lost or shared devices increase exposure. |
Use sensible password controls alongside MFA
Require unique passwords for every service and encourage a reputable password-management tool to generate and store them. A password manager improves uniqueness and length; it does not replace MFA or protect an account whose recovery path is weak.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Do not force routine password changes on a calendar merely because a policy says passwords must rotate. CISA warns that predictable, frequent changes can lead users to make small variations that are easy to guess. Change a password when it is exposed, reused, suspected of compromise, or when a specific risk event requires it. Block known-compromised passwords where the identity platform supports that feature.
Apply the controls by role and exposure
| Account or system | Minimum direction | Additional review |
|---|---|---|
| Administrators | FIDO/WebAuthn where supported, separate admin identity, least privilege, short sessions, and recovery notifications. | Audit every privileged role and registered authenticator. |
| Email accounts | MFA for every user, phishing-resistant method preferred, unique password, and alerts for forwarding or security changes. | Email often controls recovery for other services, so treat it as high value. |
| Remote access | MFA, narrow authorization, and reauthentication when sessions expire. | Review who can connect and from which managed devices or networks. |
| Sensitive-data applications | MFA, role-based permissions, monitored recovery, and risk-based session expiry. | Remove dormant accounts and unnecessary data access. |
| Standard users | MFA enrollment, unique password, at least one backup authenticator, and recovery alerts. | Teach users to reject unexpected push prompts and report them. |
Implementation sequence for an organization
- Inventory identities, administrators, remote-access paths, sensitive applications, recovery contacts, and active sessions.
- Turn on MFA for administrators, email, remote access, and sensitive systems before expanding to the rest of the workforce.
- Offer FIDO/WebAuthn security keys or passkeys and register a spare; configure number matching only where phishing-resistant methods are not yet available.
- Separate privileged and everyday accounts, remove dormant identities, and replace broad groups with defined roles.
- Document recovery methods, protect saved codes, require notifications, and test recovery with a nonproduction account.
- Require recent reauthentication for adding or removing authenticators and changing recovery details.
- Set session lifetime and reauthentication rules by role and data sensitivity; verify that expiration actually invalidates old sessions.
- Review password uniqueness, compromised-password handling, and exception accounts, then repeat the access and authenticator review on a scheduled basis.
Common weak configurations and fixes
All accounts use SMS as the only second factor
Keep SMS only as a fallback if the service offers no stronger route, then prioritize FIDO/WebAuthn enrollment for administrators and high-value accounts. Protect the phone number and add a separate recovery method.
Users approve every push notification
Enable number matching, train users to deny unsolicited prompts, and investigate repeated prompts as a possible credential attack. Move high-risk users to phishing-resistant authentication.
Recovery email is the only way back in
Protect that mailbox with its own strong MFA, add another authenticator, save recovery codes securely, and enable recovery-event alerts. If the provider cannot offer a safer route, document the limitation and reduce the account’s privilege.
Every employee has administrator rights
Create role-based permissions, separate admin identities, remove unnecessary privileges, and review membership after job changes. This limits the blast radius of an ordinary account compromise.
Sessions never expire
Configure expiration and reauthentication, starting with privileged and remote-access sessions. Test logout, token revocation, and recovery after a lost device so the policy works in practice.
What these settings can and cannot do
These controls address the main paths attackers use: stolen passwords, phishing, excessive permissions, hijacked recovery, unauthorized authenticator enrollment, and long-lived sessions. They reduce likelihood and impact rather than eliminating risk. The strongest practical baseline is phishing-resistant MFA, narrow privilege, multiple protected authenticators, observable recovery, and session rules matched to the account’s value and exposure.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
