I’ve Turned on Multifactor Authentication (MFA). Now What?

October 6, 2022

Cyber, Property & Casualty, Risk

In the 12 months preceding Palo Alto’s Unit 42 Incident Response Report, 70% of the cases they worked on were ransomware or business email compromise (BEC). Further, two of the top 3 access vectors that attackers used are related to usernames and passwords, specifically credential phishing and brute-force credential attacks. A critical control that could have either stopped or led to detection of these events in 50% of the cases is multi-factor authentication (MFA).

As we’ve seen in the cyber insurance industry, MFA has now become a standard control that just about every carrier wants in place before offering coverage.

You may be thinking, with MFA turned on, my organization is no longer vulnerable to these types of attacks, right? Unfortunately, cyber criminals are ceaseless in their ventures to steal money, data, or resources, and they have found ways to work with or around the MFA systems that organizations have put in place.

MFA Fatigue

In just the past few months, we’ve seen multiple large organizations who had MFA required for access to their systems face breaches. Hackers have found that if they continuously bombard a user with the push notifications that are very common in many of today’s MFA solutions, at some point the user will click “allow” to make the notifications stop. This is known as “MFA fatigue”, and we are starting to see an increase in this methodology used to bypass MFA.

Legacy Protocols

As organizations continue digital transformation initiatives, they often have older systems that would be costly to replace, but are necessary in their day-to-day work. An example that is in wide use by businesses is copier/scanner/printers that have scan to email capabilities. These systems were not originally designed to use MFA to create a connection to send those documents via email. As companies move to cloud-based email systems, these devices continued to use a username and password combination, known as basic authentication. Cyber criminals could take advantage of these accounts and use them to conduct phishing attacks.

What can I or my organization do?

Training

Once MFA is implemented, its use and things to watch out for, such as MFA fatigue, should be part of an organization’s security awareness training program. An employee should feel comfortable knowing that if they start to receive a large number of MFA notifications, they should immediately inform their IT or security departments.

IT Inventory

An organization should have an inventory of all hardware and software that is used for their business purposes. In doing so, they can be aware when security vulnerabilities that apply to those technologies are released. Additionally, they can better understand the situations where security risks may need to be accepted to maintain business operations, while planning for how to mitigate those risks.

Starting this month, Microsoft will deprecate/disable basic authentication in Exchange Online as a default setting, however organizations can still keep it enabled to support situations where MFA is not supported. Organizations should be aware of, and monitor, those accounts that don’t require MFA.