New Microsoft guidance for the CISA Zero Trust Maturity Model
...—In this customer story, the USDA implements phishing-resistant multifactor authentication (MFA)—which is important aspect of the identity pillar of the CISA Zero Trust Maturity Model.
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
...and avoiding password reuse. Enforce multi-factor authentication (MFA) on all accounts, remove users excluded from MFA...and strictly require MFA from all devices, in all locations, at all times. Microsoft continues to expand MFA defaults for products and services like Azure to broaden MFA adoption.Consider...transitioning to a passwordless primary authentication method, such as Azure MFA, certificates, or Windows Hello for Business...
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
...multifactor authentication (MFA). Implementation of MFA remains an essential pillar in identity security and is highly effective at stopping a variety of threats. Leverage...phishing-resistant authentication methods such as FIDO Tokens, or Microsoft Authenticator with number matching. Avoid telephony-based MFA methods to avoid risks associated with SIM-jacking... ap-northeast-1-aws.s3-ua[.]cloudap-northeast-1-aws.ukrainesec[.]cloudca-central-1.gov-ua[.]cloudca-central-1.ua-gov[.]cloudca-west-1.aws-ukraine[.]cloudca-west-1.mfa-gov[.]cloudca-west-1.ukrtelecom[.]cloudcentral-2-aws.ua-mil[.]cloud...
IT executives prioritize Multi-Factor Authentication in 2020
In 2020, many IT executives will roll out or expand their implementation of Multi-Factor Authentication (MFA) to better safeguard identities. This is one of the key findings of a survey conducted by Pulse Q&A for Microsoft in October 2019.1 Specifically, 59 percent of executives will implement or expand MFA within three to six...months. Another 26 percent will do so within 12 months. These executives are initiating these projects because they believe that MFA provides better security preparedness. They’re right. MFA, which requires that users authenticate with at least two factors, can reduce the risk of i...be attributed to weak or compromised passwords, according to Verizon’s 2019 Data Breach Investigations Report. MFA reduces risk because it’s significantly harder to compromise two or more authentication f...
How to implement Multi-Factor Authentication (MFA)
Another day, another data breach. If the regular drumbeat of leaked and phished accounts hasn't persuaded you to switch to Multi-Factor Authentication (MFA) already, maybe the usual January rush of 'back to work' password reset requests is making ...deploy it straight away? The problem is that deploying MFA at scale is not always straightforward. There are technical issues that may hold you up, but the people side is where you have to start. The eventual goal of an MFA implementation is to enable it for all your users on all of your systems all of the time, b...that on day one. To successfully roll out MFA, start by being clear about what you're going to protect, decide what MFA technology you’re going to use, and understand what the impact on employees is going to be. Otherwise, your MFA deployment might grind to a halt amid complaints from users who run into problems while try...
Token tactics: How to prevent, detect, and respond to cloud token theft
As organizations increase their coverage of multifactor authentication (MFA), threat actors have begun to move to more sophisticated techniques to allow them to compromise corporate resources without needing to satisfy MFA. Recently, the Microsoft Detection and Response Team (DART) has seen an increase in attacke...utilizing token theft for this purpose. By compromising and replaying a token issued to an identity that has already completed multifactor authentication, the threat actor satisfies the validation of MFA and access is granted to organizational resources accordingly. This poses to be a concernin...identity platforms, such as Azure Active Directory (Azure AD). To access a resource (for example, a web application protected by Azure AD), a user must present a valid token. To obtain that token, the user must sign into Azure AD using their credentials. At that point, depending on policy, they may be required to complete MFA. The user then presents...
Your password doesn’t matter—but MFA does!
Your pa$$word doesn’t matter—Multi-Factor Authentication (MFA...) is the best step you can take to protect your accounts. Using anything beyond passwords significantly increases the costs for attackers, which is why the rate of compromise of accounts using any MFA is less than 0.1 percent...and Real-Time Phishing are the most dominant ways we see non-password authenticators compromised. Channel independent, verifier impersonation-resistant authenticator types—such as smartcards, Windows Hello, and FIDO—are incredibly hard to crack. Given an overall strong authentication rate of only about 10 percent, doing any form of MFA takes...
Quick wins—single sign-on (SSO) and Multi-Factor Authentication (MFA)
With Multi-Factor Authentication (MFA) and single sign-on (SSO) being a few of the most effective countermeasures against modern threats, organizations should consider a Cloud Identity as a Service (IDaaS), and MFA solution, like Azure Active Directory (AD). Here are seven benefits: Azure AD is si...with almost everything, meaning once identity is in the cloud. It may be accessed by any entity that requires access and used for all on-premises and cloud applications. Azure AD MFA—using the Microsoft Authenticator app—is one the easiest MFA solutions for users to adopt and one of the fastest ways to take a passwordless approach. ..."identity sprawl," so you can have one identity in multiple applications per user. To learn more, read Azure AD Seamless Single Sign-on. A single, unified MFA reduces the success of phishing attacks due...
DEV-1101 enables high-volume AiTM campaigns with open-source phishing kit
...are part of an increasing trend that is observed supplanting many other less advanced forms of phishing. AiTM phishing is capable of circumventing multifactor authentication (MFA) through reverse-proxy functionality. DEV-1101 is an actor tracked by Microsoft responsible...Credential harvester mimicking a Microsoft sign-in portal. At this point, the actor’s server captures credentials entered by the user. If the user has MFA enabled, the AiTM kit continues to function as a proxy between the user and the user’s sign-in service, meaning, as the user...completes an MFA sign-in, the server captures the resulting session cookie. The attacker can then bypass MFA with the session cookie and the user’s stolen credentials. The following diagram illustrates the AiTM phishing attack chain...
STRONTIUM: Detecting new patterns in credential harvesting
...multi-factor authentication (MFA) across both business and personal email accounts successfully thwarts the majority of credential harvesting attacks. Our colleagues in Azure Active Directory put it more precisely— “… doing any form...of MFA takes you out of reach of most attacks. MFA (using any mechanism) is just too costly to break - unless a highly motivated attacker is after that high-value account or asset.” Blog...: Your password doesn’t matter—but MFA does! However, most enterprise accounts have not implemented this simple protection...
Changing the Monolith—Part 4: Quick tech wins for a cloud-first world
Authentication (MFA) must be enforced for all users as well, not just highly privileged users. Remember that it...). Start with MFA. Requiring...MFA for all applications, whether on-premises or in the cloud, is a great start. When using MFA, consider enforcing...
Detecting and mitigating a multi-stage AiTM phishing and BEC campaign
...of indirect proxy in this campaign provided attackers control and flexibility in tailoring the phishing pages to their targets and further their goal of session cookie theft. After signing in with the stolen cookie through a session replay attack, the threat actors leveraged multifactor authentication (MFA) policies that have not been configured using...security best practices in order to update MFA methods without an MFA challenge. A second-stage phishing campaign followed, with more than 16,000 emails sent to the target’s contacts. This attack highlights the complexity of AiTM attacks and the comprehensive defenses they necessitate...This sophisticated AiTM attack requires beyond the typical remediation measures for identity compromise such as a password reset. Affected organizations need to revoke session cookies and roll back MFA modifications made by the threat actor. The incident also highlights the importance of proa...