Cyber Defense eMagazine December Edition for 2021

More documents

Recommendations

Info

The second kind of MFA is SMS two-factor authentication (the most common OTP delivery method today), wherein OTP are delivered to a user’s smartphone via text. Again, due to error or malicious activity, OTP can be delivered to the wrong mobile number or a stolen mobile phone or intercepted via SS7 network attacks. In fact, the National Institute of Standards and Technology (NIST) stopped recommending the use of SMS as a strong second factor back in 2016! And finally, PUSH authentication is another mobile-centric authentication method whereby the service provider sends the user a notification to their mobile phone. The user then has to tap the screen to get access to the account. And while PUSH authentication can be used as part of a passwordless system if the solution is built upon PKI or certificate-based authentication, most PUSH authentication is an MFA mode layered on top of additional shared secrets, including (you guessed it) a password. Unfortunately, many hackers have learned how to bypass traditional MFA, including intercepting, phishing and spoofing SMS text messages; many also engage in SIM swapping, wherein a hacker impersonates the target to dupe a wireless carrier employee into porting the phone number associated with their SIM card to a new (malicious) device. Moreover, there also new tools – e.g., Modlishka – that automate phishing attacks that bypass MFA. It couldn’t be easier for hackers nowadays. So, the question is, how do we move away from passwords yet still ensure enterprise level security? Every individual today is experiencing a certain level of MFA fatigue, then add the fact that every business, big and small, is maneuvering through the complex authentication landscape, while now managing the IT challenges of remote work. In fact, enterprise IT helpdesk departments spend more than 30% of their time helping users with password and access issues, which prevents them from making progress on innovative projects that ultimately move the business forward. So, despite being mandated, MFA still carries a level of resistance. The solution? Marrying MFA with passwordless authentication. In short, combining MFA technology with a biometric login (think facial recognition). This concept removes any type of shared secret and eliminates the transmission or storing of credentials, thus removing the “man in the middle” and reducing the attack surface. By simply using a smartphone, security key, or platform authenticator, users can securely log into a workstation and corporate domain, without ever typing in a password. Passwordless authentication removes user frustration while ensuring the highest level of password security – by eliminating the password altogether. Leading companies such as Aetna/CVS Health, most major banks in the United States, airlines and insurance companies have all adopted passwordless technologies. Moving forward, passwordless authentication will certainly be the norm, particularly since the Federal Financial Institutions Examination Council (FFIEC) recently issued a guidance on effective authentication and access risk management practices for the various parties that access financial institution services and systems. Microsoft, in particular, is taking the lead in incorporating this technology and making it nonnegotiable for entities with data to secure (or, all entities). In fact, a Digital Defense Report recently distributed by Microsoft shows continued attacks from other nation-states that weren’t necessarily via exploitations of software, but rather well-known techniques such as password spray and phishing. This Cyber Defense eMagazine – December 2021 Edition 58 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
just highlights how vulnerable most organizations are to attacks, and how widespread the antiquated use of passwords is amongst the population. With the number of digital touchpoints increasing for companies across the board, MFA alone – and MFA rooted in password security – will continue to become less and less secure for both brands and consumers. With countless pieces of data and dollars to lose, neither party can afford to put their information at risk. Under the FFIEC’s guidance, and with Microsoft at forefront, Passwordless MFA is the way of the future. About the Author Bojan Simic is the Interim CEO, Chief Technology Officer and Co-Founder of HYPR. Previously, he served as an information security consultant for Fortune 500 enterprises in the financial and insurance verticals conducting security architecture reviews, threat modeling, and penetration testing. Bojan has a passion for deploying applied cryptography implementations across security-critical software in both the public and private sectors. His extensive experience in decentralized authentication and cryptography have served as the underlying foundation for HYPR technology. Bojan also serves as HYPR’s delegate to the FIDO Alliance board of directors, empowering the alliance’s mission to rid the world of passwords. Bojan can be reached online on LinkedIn, Twitter and at our company website https://www.hypr.com. Cyber Defense eMagazine – December 2021 Edition 59 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
Page 1 and 2:
9 Ways Social Media Sabotages Your
Page 3 and 4:
How Do You Secure the Modern Supply
Page 5 and 6:
@CYBERDEFENSEMAG CYBER DEFENSE eMAG
Page 7 and 8: Cyber Defense eMagazine - December
Page 39 and 40: With over 4 billion users, social m
Page 41 and 42: Unsecure Mobile Networks When using
Page 43 and 44: However, as concerning as these pra
Page 45 and 46: Danny Lopez, CEO, Glasswall “Duri
Page 47 and 48: estoring data. Modern organizations
Page 49 and 50: When Diplomacy, Finance and Tech Co
Page 51 and 52: Another way leaders can take initia
Page 53 and 54: How Covid-19 Changed Advertising Fo
Page 55 and 56: However, this shift might not be su
Page 57: Why MFA Alone Isn’t Enough for Tr
Page 61 and 62: on channels like email. This starts
Page 63 and 64: 3 Best Practices to Avoid Inevitabl
Page 65 and 66: For example, an employee may become
Page 67 and 68: and outcomes is essential for proje
Page 69 and 70: Electric Vehicle Charging: The Next
Page 71 and 72: Going forward, EV dealers, charging
Page 73 and 74: How does this relate to MFA? Well,
Page 75 and 76: constant exposure of countries to a
Page 77 and 78: Why do you need a malware sandbox?
Page 79 and 80: Multi-Cloud Security and Compliance
Page 81 and 82: If security controls are not consol
Page 83 and 84: How Do You Secure the Modern Supply
Page 85 and 86: The case for isolation Supply chain
Page 87 and 88: Don’t Take Yourself Out of The Ga
Page 89 and 90: The U.S. Government Accountability
Page 91 and 92: assessment criteria for the tasks f
Page 93 and 94: the file. This was a great techniqu
Page 95 and 96: the wake of the pandemic where the
Page 97 and 98: Certain communications are protecte
Page 99 and 100: At Salt Communications we work with
Page 101 and 102: And it’s only getting worse. If y
Page 103 and 104: The benefits are great When HDOs ha
Page 105 and 106: 4 Pillars of Privacy-Preserving AI
Page 107 and 108: concern and a desire to be cautious
Page 109 and 110:
and stay safe online. That’s why
Page 111 and 112:
2. Enabling over-the-horizon threat
Page 113 and 114:
Techniques Used by Hackers to Bypas
Page 115 and 116:
Phishing scams avoid email security
Page 117 and 118:
ATO Detection Account takeover bene
Page 119 and 120:
How To Protect Your Digital Legacy
Page 121 and 122:
I worked with cybersecurity experts
Page 123 and 124:
Sextortion Email Scams What to Do a
Page 125 and 126:
Sextortion attacks are a type of cy
Page 127 and 128:
How to respond to a sextortion emai
Page 129 and 130:
Example 2:'You've been hacked' emai
Page 131 and 132:
How can this strategy be implemente
Page 133 and 134:
Surviving The New Era of Terabit-Cl
Page 135 and 136:
accompanying shift toward more digi
Page 137 and 138:
Survey results show businesses are
Page 139 and 140:
Enterprises Cannot Achieve Zero Tru
Page 141 and 142:
Capital One breach back in 2019. Ad
Page 143 and 144:
Cyber Defense eMagazine - December
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
CyberDefense.TV now has 200 hotseat
Page 163 and 164:
Books by our Publisher: https://www
Page 165 and 166:
Page 167 and 168:
show all

Cyber Defense eMagazine December Edition for 2021

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?