Web mail – how do you access? What security concerns do you have?

How many of you have web email access for your employees?

For those of you who do, do you allow access via only userid and password?

Do you have/or plan to adopt a multi-factor authentication solution for accessing web email?

FYI, we are deploying a software token on the new laptops we are rolling out this year to improve our remote access security. The question has come up about whether we need to also secure our web email solution for when employees access it via their home computers. We could issue hardware tokens for this purpose, but we’re not sure the risk is worth it.

What are all of you doing?