Multi-Factor Authentication Is No Shortcut To Cyber Resilience

Two high-profile breaches in recent months remind us of an unfortunate truth: true cyber resilience means preparing for attackers to eventually find a way in.

In both breaches, attackers acquired not only ordinary employee login credentials, but also multi-factor authentication credentials meant to protect against the former theft. Their method for doing so? Old-fashioned persistence - specifically, repeated requests to one or more employees until someone finally gave in.

This isn’t to criticise any breached organisations that clearly take security seriously. Widespread MFA implementation is no small feat. Completing that step puts organisations far ahead of most industries’ cybersecurity curve. Instead, these breaches send a clear message to organisations who treat MFA - or any other single security step - as a shortcut or stand-in for broader cyber resilience.

Modern attackers are numerous and persistent enough that broader technological and cultural changes are needed to stop the attackers that inevitably make it past the network perimeter.

Reducing Confusion & Making Resilience More Concrete

In my experience, organisations don’t tend to settle on cyber resilience shortcuts out of laziness. Instead, the impulse often comes from confusion about minimising and mitigating attacks that have already partially succeeded. The ongoing conversation around Zero Trust security is an excellent example — the average organisation hears so many different interpretations and pitches about Zero Trust that it’s difficult to tell which strategies fall under the umbrella.

The precise answer to that confusion will vary by organisation and industry. But in talking with clients and partners about cyber resiliency, I’ve seen some patterns emerge. Here are examples of the attack types related to the breaches mentioned above:

  • Successful organisations find ways to reduce the potential for employees to make the ‘wrong decision’ during an attack. For example, cloud email security can remove malicious emails from the inbox before a human sees them, and browser isolation can isolate a suspicious site, ensuring local conditions remain benign.
  • When employees make the ‘right decision,’ or the system rejects a malicious message, I see successful organisations use Secure Web Gateway (SWG) services to block malicious domains and allow or block specific IPs — especially with many employees working from their home network. Threat intelligence feeds these services to help ensure humans don’t reach known malicious content.
  • When an employee does make the wrong decision and mistakenly provides their credentials, successful organisations still prevent an active session controlled by the attacker from starting. Phishing-resistant MFA (like physical security keys) implemented through Zero Trust Network Access (ZTNA) can help here.
  • Finally, user-centric, consolidated logging can support incident response teams should a successful attack still occur.

Again, these steps apply primarily to phishing-based MFA compromise breaches mentioned previously - but other resources can present a broader picture.

The Right Culture Supports Resilience

Implementing such capabilities takes time. In the meantime, a robust organisational security culture can help fill the gaps. Education and encouraging teams to over-report potential threats are essential steps. Removing the stigma and negative consequences of successful attacks is equally important.

A prime example of this can be found in an article from Cloudflare that covers their successful response to a phishing attack. The company uses the term “paranoid but blame-free” to describe this approach. When three Cloudflare employees correctly suspected they’d fallen for phishing, they alerted the security team immediately, knowing they would not be punished. As a result, the team could block the phishing site three minutes after the attack began and reset the leaked credentials shortly afterwards.

This combination of alertness and consequence-free reporting can go a long way towards the ultimate goal of cyber resilience - making employees at every level of an organisation feel invested in better security.

What More Can We Do To Stay Cyber-Secure?

The approach described above is good practice, but additional layers are needed to further aid organisations wanting to improve their cybersecurity posture. 

Hardware security keys provide next-level security. Businesses can provide physical keys to employees, meaning they don’t have to rely on a digital code to unlock services. Ultimately, this cannot be phished. Hardware security keys leverage cryptography to verify and validate employee identity and prove the legitimacy of the URL login page. This works by only using the original domains of websites to generate the key – something that code–based MFA lacks.

This additional layer of complexity can replace the less secure MFA option that has its flaws. But it also requires employees to fully invest in using the keys and resist reverting to app-based codes when necessary. 

This technology is one that security-conscious organisations need to have on their radar moving forward into 2023 and beyond. 

Attitudes & Behaviours Are As Crucial As protocols & Technologies

There are no certainties in the practice of defining cybersecurity protocols, particularly as the threat landscape evolves at least as fast as, and often faster than, the mitigations we create to defeat it. 

However, as described above, it’s perhaps a combination of a proactive detection and avoidance stance, along with a culture that encourages the right attitudes and behaviours in employees and stakeholders, who are at the front line of these threats, that is most likely to deliver the resilience we all seek

Adrian Odds is Marketing & Innovation Director at CDS

You Might Also Read: 

Blame The Boss For Cyber Attacks:

 

« Security Risks In 5G Mobile
EU Fines Meta $416m »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Center for a New American Security (CNAS)

Center for a New American Security (CNAS)

CNAS is the nation's leading research institution focused on defense and national security policy. Cyber security issues are an intrinsic element of the national security debate.

Netsparker

Netsparker

Netsparker provide a web application security scanner to automatically find security flaws in your websites, web applications and web services.

BitSight Technologies

BitSight Technologies

BitSight transforms how companies manage information security risk with objective, verifiable and actionable Security Ratings.

J2 Software

J2 Software

J2 Software is a leading African Information Security and ICT business providing information security, governance, risk and compliance solutions.

3Elos

3Elos

3Elos operates in the Information Technology market with a focus on research, development, consulting, marketing and implementation of Information Security solutions.

IoT Cybersecurity Alliance

IoT Cybersecurity Alliance

IoT Cybersecurity Alliance is where industry-leading IoT security providers and top IoT experts come together to establish and share best practices to secure the IoT ecosystem for the good of all.

GCHQ Apprenticeships

GCHQ Apprenticeships

GCHQ, the UK intelligence and security organisation, offers a unique three-year Cyber Security Degree Apprenticeship with employment on successful completion.

Neudomains

Neudomains

Neudomains is a Corporate Domain Name Management and Brand Protection Online Specialist. One of the world's top providers of online brand protection and enforcement.

418sec

418sec

418sec prevent problematic open source code from ever entering an organisation, allowing developers and risk owners to trust the code they use.

Sentor Managed Security Services

Sentor Managed Security Services

Sentor Managed Security Services is a cybersecurity company that enables organizations to exist in a digitally connected world.

TryHackMe

TryHackMe

TryHackMe is an online platform that teaches cyber security through short, gamified real-world labs. We have content for both complete beginners and seasoned hackers.

DataSixth Security Consulting

DataSixth Security Consulting

DataSixth delivers Cybersecurity Intelligence. With our unique capabilities, we’re able to deliver value, deliver answers, and deliver actionable security intelligence.

Assure IT

Assure IT

Assure IT is a Singapore company specialising in technology governance, risk and compliance.

Jisc

Jisc

Jisc is a membership organisation working in partnership with the UK’s research and education communities to develop the digital technologies they need to teach, discover and thrive.

GajShield

GajShield

GajShield Infotech provides Data Security Firewall solutions to Corporate’s and Government agencies.

National Coordinator for Security and Counterterrorism (NCTV) - Netherlands

National Coordinator for Security and Counterterrorism (NCTV) - Netherlands

The NCTV serves the Netherlands’ national security. We protect national interests, identify threats and strengthen resilience.