Case Studies

Multi-factor Authentication- Flops and Failures

The do’s and do not’s of implementing MFA across your organization… based on things we’ve seen as a professional provider.

The Solutions

Implement Tools You Trust – Trusted tools are important when you are looking to implement MFA. You want to go with something like MS Authenticator or Duo.

Set The Company Policy – Making MFA compliance a company policy allows you to hold your employees accountable. This also sets the tone and expectations around your organization’s security stance.

Enforce This On Everyone – Always enforce your MFA policy org-wide. No one should be allowed bypass this because they will always be the security vulnerability.

MFA Do’s and Don’ts

Multifactor authentication (MFA) is a critical security protocol put in place to validate a person’s identity when they log into technology. MFA is the utilization of multiple forms of authentication in conjunction. This includes passwords, facial recognition, or fingerprint authentication, alongside something you have (i.e. Microsoft Authenticator app).

But what are common issues companies face when implementing and enforcing the policy? Here are the do’s and don’ts of MFA implementation:

When implementing it for user accounts within the organization

• DO: Apply this policy to ALL people.
• DONT: Allow exceptions to this rule. There are always people who think they should not be included in this, but we assure you that it is always those people that create security vulnerabilities. All means all in this policy.

When implementing on network access points – I.e. VPN connections for all of your remote workers

• DO: Require MFA at these points.
• DONT: Allow any exceptions. People always say they do not have the time to deal with MFA – this is not true. It takes less time to sign in properly than to recover from a ransomware attack.
• BONUS: Moving away from on-premise servers to cloud based services such as Azure Active Directory (AAD) and SharePoint eliminates the need for VPNs.

When choosing your MFA tools

• DO: Implement a tool created by a trusted developer. Tools such as Microsoft Authenticator, or CISCO’s DUO Authenticator can be trusted.
• DONT: Set up text message, or phone call authentication. Text messages and phone calls can be easily intercepted.

A story for you:

An administrator’s account password was intercepted with a common attack called a man-in-the-middle attack. The threat actor (TA) then used the administrator’s credentials to gain access to the corporate network via the VPN. From there the TA was able to gain unfettered access to the domain, create back door access, and ultimately distribute ransomware across the devices on the network.

If the administrator had MFA enabled on their account they would have been notified when someone was attempting to log into the VPN using their credentials. The administrator could have then blocked the sign in, changed their password, and prevented a ransomware event from occurring.