Turning on MFA to Protect Identities 

External attack surfaces, such as the network perimeter and cloud accounts, are being scanned and tested all the time. It’s not unusual to have large volumes of malicious logon attempts to connect to your network.

Assuming you’ve built a secure perimeter, an identity is the front door to your organisation. It is the legitimate method for users and partners to remotely access your systems and data.

Only having a user ID and a password to protect that access is a high-risk strategy. Passwords can be compromised through various means including phishing, brute force attacks, malware, or stolen in a data breach.

Requiring a second authentication factor, such as something you have or something you are, over and above a password makes it substantially harder for a user account to be compromised. Enforcing Multi Factor Authentication (MFA) will probably contribute to the single biggest reduction in risk around your identities you can make.

SOC monitoring and alerting is essential, and we can monitor and investigate anomalous logins based on behaviours, locations and devices for example. However, it is no replacement for securing on-line accounts with MFA.

Microsoft provide all you need to implement MFA using Conditional Access, along with an authenticator app on your phone. MFA has been around for a long time now and most people are familiar with the concept, to access their bank accounts for example, and so it’s easy to forget not all organisations have implemented it across their own user accounts yet.

If security is not embedded into the culture of an organisation, there may be some minor resistance to overcome around inconvenience to set up and use, needing a personally owned phone for the authenticator app, or even other IT priorities.

In response, it’s worth remembering Microsoft research has found MFA can block over 99.9% of all account compromise attacks. It’s also worth noting that MFA for online accounts has become a requirement of the latest control requirements for Cyber Essentials, and it is yet another reminder to get the basics covered first.

If you need help or advice with security operations or deploying preventative security controls such as MFA and conditional access policies across an organisation, please get in touch.