Cyber Defense eMagazine December Edition for 2021
Will you stay one step ahead of Cyber Scrooge this year? Learn new ways to protect your family, job, company & data. December Cyber Defense eMagazine: Cyber Deception Month is here...Defeat Cyber Scrooge! Cyber Defense Magazine December Edition for 2021 in online format #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, International Editor-in-Chief and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES See you at RSA Conference 2022 - Our 10th Year Anniversary - Our 10th Year @RSAC #RSACONFERENCE #USA - Thank you so much!!! - Team CDMG CDMG is a Carbon Negative and Inclusive Media Group.
Will you stay one step ahead of Cyber Scrooge this year? Learn new ways to protect your family, job, company & data. December Cyber Defense eMagazine: Cyber Deception Month is here...Defeat Cyber Scrooge!
Cyber Defense Magazine December Edition for 2021 in online format #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, International Editor-in-Chief and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES
See you at RSA Conference 2022 - Our 10th Year Anniversary - Our 10th Year @RSAC #RSACONFERENCE #USA - Thank you so much!!! - Team CDMG
CDMG is a Carbon Negative and Inclusive Media Group.
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
The second kind of MFA is SMS two-factor authentication (the most common OTP delivery method<br />
today), wherein OTP are delivered to a user’s smartphone via text. Again, due to error or malicious<br />
activity, OTP can be delivered to the wrong mobile number or a stolen mobile phone or intercepted via<br />
SS7 network attacks. In fact, the National Institute of Standards and Technology (NIST) stopped<br />
recommending the use of SMS as a strong second factor back in 2016!<br />
And finally, PUSH authentication is another mobile-centric authentication method whereby the service<br />
provider sends the user a notification to their mobile phone. The user then has to tap the screen to get<br />
access to the account. And while PUSH authentication can be used as part of a passwordless system if<br />
the solution is built upon PKI or certificate-based authentication, most PUSH authentication is an MFA<br />
mode layered on top of additional shared secrets, including (you guessed it) a password.<br />
Un<strong>for</strong>tunately, many hackers have learned how to bypass traditional MFA, including intercepting,<br />
phishing and spoofing SMS text messages; many also engage in SIM swapping, wherein a hacker<br />
impersonates the target to dupe a wireless carrier employee into porting the phone number associated<br />
with their SIM card to a new (malicious) device. Moreover, there also new tools – e.g., Modlishka – that<br />
automate phishing attacks that bypass MFA. It couldn’t be easier <strong>for</strong> hackers nowadays.<br />
So, the question is, how do we move away from passwords yet still ensure enterprise level<br />
security?<br />
Every individual today is experiencing a certain level of MFA fatigue, then add the fact that every<br />
business, big and small, is maneuvering through the complex authentication landscape, while now<br />
managing the IT challenges of remote work. In fact, enterprise IT helpdesk departments spend more than<br />
30% of their time helping users with password and access issues, which prevents them from making<br />
progress on innovative projects that ultimately move the business <strong>for</strong>ward. So, despite being mandated,<br />
MFA still carries a level of resistance.<br />
The solution? Marrying MFA with passwordless authentication. In short, combining MFA technology with<br />
a biometric login (think facial recognition). This concept removes any type of shared secret and eliminates<br />
the transmission or storing of credentials, thus removing the “man in the middle” and reducing the attack<br />
surface. By simply using a smartphone, security key, or plat<strong>for</strong>m authenticator, users can securely log<br />
into a workstation and corporate domain, without ever typing in a password. Passwordless authentication<br />
removes user frustration while ensuring the highest level of password security – by eliminating the<br />
password altogether. Leading companies such as Aetna/CVS Health, most major banks in the United<br />
States, airlines and insurance companies have all adopted passwordless technologies.<br />
Moving <strong>for</strong>ward, passwordless authentication will certainly be the norm, particularly since the Federal<br />
Financial Institutions Examination Council (FFIEC) recently issued a guidance on effective authentication<br />
and access risk management practices <strong>for</strong> the various parties that access financial institution services<br />
and systems. Microsoft, in particular, is taking the lead in incorporating this technology and making it nonnegotiable<br />
<strong>for</strong> entities with data to secure (or, all entities). In fact, a Digital <strong>Defense</strong> Report recently<br />
distributed by Microsoft shows continued attacks from other nation-states that weren’t necessarily via<br />
exploitations of software, but rather well-known techniques such as password spray and phishing. This<br />
<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>December</strong> <strong>2021</strong> <strong>Edition</strong> 58<br />
Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.