The MFA you have isn’t the MFA you think you have

Having MFA Enabled Doesn't Mean Your Accounts Are Secure

Multi-factor authentication (MFA) has long been considered one of the most effective defences against account compromise. But not all MFA methods provide the same protection, and attackers have become increasingly effective at bypassing traditional approaches. A recent CSO Online opinion piece highlights why organisations need to look beyond MFA adoption rates and examine the actual protection their authentication methods provide.

What Happened

• Traditional MFA methods remain vulnerable. SMS codes, one-time passwords and push notifications can be compromised through phishing, SIM swapping and MFA fatigue attacks, where users are repeatedly prompted to approve a login.
• Attackers are bypassing MFA without defeating the technology itself. Adversary-in-the-middle phishing tools can intercept authentication codes and hijack authenticated sessions. High-profile incidents, including breaches involving Uber and MGM Resorts, demonstrate that having MFA enabled does not necessarily prevent account compromise.
• Phishing-resistant authentication offers stronger protection. FIDO2 security keys and passkeys use cryptographic authentication tied to legitimate websites, preventing attackers from simply capturing and replaying credentials. However, weaker fallback methods and legacy applications can undermine these protections.

The Cyooda View

MFA remains an essential security control, but organisations need to stop treating it as a simple tick-box exercise.

A report showing 100% MFA adoption might look reassuring to a board, insurer or auditor, but it tells you very little about the actual level of protection. An employee receiving an SMS code and an administrator using a FIDO2 hardware security key are both counted as MFA-enabled, despite very different levels of resistance to phishing.

In my experience, the challenge isn't necessarily getting organisations to deploy MFA. It's ensuring they understand where their authentication controls remain vulnerable.

For law firms, this is particularly important. Microsoft 365 accounts provide access to confidential client communications, sensitive documents and potentially privileged information. Compromising a single account can have serious consequences.

Organisations should review which MFA methods are actually in use, prioritise phishing-resistant authentication for administrators and high-risk users, and examine whether legacy authentication methods, account recovery procedures or weaker fallback options undermine their security.

The question security leaders should be asking is no longer simply 'Do we have MFA enabled?' but 'Would our MFA withstand a modern phishing attack?'

Source: CSO Online Original: Read More