Multi-factor auth fatigue is real – and it's why you may be in the headlines next
(2022/11/03)
- Reference: 1667508315
- News link: https://www.theregister.co.uk/2022/11/03/mfa_fatigue_enterprise_threat/
- Source link:
Analysis The September cyberattack on ride-hailing service Uber began when a criminal bought the stolen credentials of a company contractor on the dark web.
The miscreant then repeatedly tried to log into the contractor's Uber account, triggering the two-factor login approval request that the contractor initially denied, blocking access. However, eventually the contractor accepted one of many push notifications, enabling the attacker to log into the account and get access to Uber's corporate network, systems, and data.
The app maker became the latest [1]high-profile victim of multi-factor authentication (MFA) fatigue, an ever growing cybersecurity problem in which attackers are able to work their way around a cornerstone of modern defenses at a time when threat groups are shifting their focus away from infecting endpoints and instead are targeting identity.
[2]
Microsoft and [3]Cisco Systems were also victims of MFA fatigue – also known as MFA spamming or MFA bombing – this year, and such attacks are rising rapidly. [4]According to Microsoft , between December 2021 and August, the number of multi-factor MFA attacks spiked. There were 22,859 Azure Active Directory Protection sessions with multiple failed MFA attempts last December. In August, there were 40,942.
A hole in MFA
MFA is among a number of security offerings designed to protect enterprises from cyberthreats and the problem of employees inadvertently clicking on malicious email attachments or URLs designed to steal credentials, including the usernames and passwords needed for single-factor sign-ins. Another authentication factor is needed, ranging from fingerprint or facial recognition to a PIN or an answer to a security question.
There also are push notifications, which are prompts on a user's mobile device if there is an attempt to use their credentials to sign into a system or account. The prompts ask for verification that the user is the one trying to sign in.
[5]
[6]
In an MFA fatigue situation, the attacker uses the stolen credentials to try to sign into an protected account over and over, overwhelming the user with push notifications. The user may initially tap on the prompt saying it isn't them trying to sign in, but eventually they wear down from the spamming and accept it just to stop their phone going off. They may assume it's a temporary glitch or an automated system causing the surge in requests.
An IT department could introduce a policy that blocks the user from logging in, and ending the MFA spam, after a certain number of failed requests, though such a policy may not be possible (depending on the tech involved) or could be exploited to lock out employees as a form of denial-of-service attack. The worker may also accept the request before the limit is reached. But this option may be there for you to consider.
[7]
That said, sometimes the attacker will pose as part of the organization's IT staff, messaging the employee to accept the access attempt.
It's all about human behavior
Like phishing and other attacks, MFA fatigue relies on social engineering to access the corporate network.
"It's an attack method which preys on the employee to be a human," John Spiegel, director of strategy and field CTO for Axis Security, told The Register .
"The intent is to get the victim to become frustrated with countless MFA requests and finally click 'approve.' We've all experienced something similar with technology. Whether it is as simple as programming the clock on a refrigerator or clicking through screens to accept all cookies to get to content we are after, we don't always validate the request. That is what the bad actor is counting on."
Threat groups run with MFA spamming
The attack is relatively simple but it's been working for cyber-crime crews. The Yanluowang gang in May used it in an attack against Cisco and later published some of the stolen data on a dark web leak site. In March, the Lapsus$ group leaked 37GB of source code stolen from Microsoft after compromising an employee via MFA fatigue.
Then there was Uber, which [8]put the blame on Lapsus$.
In a [9]report updated in May, Google-owned Mandiant pointed to a couple of Russian teams using MFA spamming in their attacks. The threat also has caught the government's attention. The US Cybersecurity and Infrastructure Security Agency (CISA) this week posted [10]fact sheets highlighting the threats to MFA and how organizations can protect themselves.
[11]
"It's a huge threat because it bypasses the security measures put in place by an organization, including one of the most effective, which is MFA," Sami Elhini, biometrics specialist at Cerberus Sentinel, told The Register . "Enterprises need to pay attention to this, because like phishing, MFA fatigue is a form of social engineering."
Enterprises relying more on MFA, zero trust
The attacks on MFA come as businesses, with the COVID-19 pandemic lifting, are adopting cloud-first and zero-trust models, which often rely on MFA to protect data and applications, Stephanie Aceves, senior director of products management at Tanium, told The Register .
"MFA fatigue poses a serious threat to organizations because it is a fairly trivial way for a patient attacker to gain access to private company resources," Aceves said, noting that it targets the most significant risk to enterprises – people who can be manipulated.
Given this, what can enterprises do to protect themselves from MFA spamming attacks? As with other forms of social engineering, educating employees about the threat is important but isn't the full and only solution. Ensuring authentication apps can't be fat-fingered and requests accepted before they can be fully evaluated would be handy.
"People have been told they need to get rid of passwords and move to MFA, but they aren't being told that the vast majority of MFA is easily phishable, as easy to steal or bypass as your password," Roger Grimes, data-driven defense analyst for KnowBe4, told The Register . "All MFA users think they are far harder to attack than if they were using a password and this simply is not true."
Because of this, users have not been given the least bit of "education about common types of attacks and how to recognize them, prevent them, and how to appropriately report. Literally, five minutes of education would make a world of difference."
That is to say: entirely relying on MFA isn't going to completely help. You still need to educate users on how to identify phishing so that they don't end their MFA codes or accept requests along with handing other credentials. You also need to architect your systems so that if or when someone does fall for a phish, the security breach is contained as much as possible and is detected as early as possible.
Number matching, request limits can help
Companies such as Microsoft are taking steps, too. Redmond, for instance, is making number matching a [12]default feature in its Authenticator app. This requires a user who responds to an MFA push notification using the tool to type in a number that appears on their device's screen to approve a login. The number will only be sent to users who have been enabled for number matching, according to Microsoft.
They're also adding other features to Authenticator, including showing users what application they're signing into and the location of the device, based on its IP address, that is being used for signing in. If the user is in California but the device is in Europe, that should raise a big red flag.
Duo in August also [13]introduced number matching in its Duo Push app. The feature, which is in early access and called Verified Duo Push, requires users to enter a verification code to "ensure only verified users are able to log in, and prevent someone absent-mindedly accepting a push they did not request," Joshua Terry, product manager at Duo, wrote in a blog post.
Okta also offers organizations what it calls a [14]"number challenge" for push notifications with its Okta Verify tool.
CISA is [15]encouraging organizations to implement anti-MFA-phishing defenses or at least number tools.
"Although number matching is not as strong as phishing-resistant MFA, it is one of the best interim mitigations for organizations who may not immediately be able to implement phishing-resistant MFA," the agency wrote.
[16]Uber explains how it was pwned this month, points finger at Lapsus$ gang
[17]Now Oktapus gets access to some DoorDash customer info via phishing attack
[18]Crooks target top execs on Office 365 with MFA-bypass scheme
[19]This big phish can swim around MFA, says Microsoft Security
As to limiting the number of unsuccessful MFA authentication requests: Okta [20]limits that number to five; [21]Microsoft and [22]Duo offer organizations the ability to implement it in their settings and adjust the number of failed attempts before the user's account is automatically locked. With Microsoft Authenticator, enterprises also can set the number of minutes before an account lockout counter is reset.
"At the end of the day, no model is perfect," Tanium's Aceves said. "As security experts, it is our responsibility to come up with controls and additional layers of defense to prevent attackers from accessing the data and resources we are tasked to protect."
For some, passwordless is the eventual goal
For companies like Microsoft, Google, and Apple, a key step will be to get rid of passwords altogether. All three in May signed onto the common passwordless sign-in [23]standard created by the FIDO Alliance and World Wide Web Consortium for everything from websites to apps and across devices and platforms.
However, broad adoption will take time. There are still legacy systems and applications that don't support password-free authentication, but the eventual goal will be eliminating what has become a key weakness in the cybersecurity chain. Until then, strengthening passwords will continue to be important.
"Not all MFA is equal and cyber-awareness is critical, along with additional security controls such as privileged access management [that] can help reduce these risks, such as moving passwords into the background and ensuring each account has strong unique complex passwords," Joseph Carson, chief security scientist and advisory CISO at Delinea, told The Register . ®
Get our [24]Tech Resources
[1] https://www.theregister.com/2022/09/19/uber_admits_breach/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/09/13/cisco_ransomware_data_leaked/
[4] https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.uber.com/newsroom/security-update
[9] https://www.mandiant.com/resources/blog/russian-targeting-gov-business
[10] https://www.cisa.gov/uscert/ncas/current-activity/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/advanced-microsoft-authenticator-security-features-are-now/ba-p/2365673
[13] https://duo.com/blog/verified-duo-push-makes-mfa-more-secure
[14] https://help.okta.com/oie/en-us/Content/Topics/identity-engine/authenticators/configure-okta-verify-options.htm
[15] https://www.cisa.gov/uscert/ncas/current-activity/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching
[16] https://www.theregister.com/2022/09/19/uber_admits_breach/
[17] https://www.theregister.com/2022/08/26/doordash_oktapus_phishing/
[18] https://www.theregister.com/2022/08/25/microsoft_365_bec/
[19] https://www.theregister.com/2022/07/13/aitm-phishing-microsoft/
[20] https://support.okta.com/help/s/article/When-does-the-MFA-Lockout-Counter-reset?language=en_US
[21] https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#account-lockout
[22] https://help.duo.com/s/article/4963?language=en_US
[23] https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/
[24] https://whitepapers.theregister.com/
The miscreant then repeatedly tried to log into the contractor's Uber account, triggering the two-factor login approval request that the contractor initially denied, blocking access. However, eventually the contractor accepted one of many push notifications, enabling the attacker to log into the account and get access to Uber's corporate network, systems, and data.
The app maker became the latest [1]high-profile victim of multi-factor authentication (MFA) fatigue, an ever growing cybersecurity problem in which attackers are able to work their way around a cornerstone of modern defenses at a time when threat groups are shifting their focus away from infecting endpoints and instead are targeting identity.
[2]
Microsoft and [3]Cisco Systems were also victims of MFA fatigue – also known as MFA spamming or MFA bombing – this year, and such attacks are rising rapidly. [4]According to Microsoft , between December 2021 and August, the number of multi-factor MFA attacks spiked. There were 22,859 Azure Active Directory Protection sessions with multiple failed MFA attempts last December. In August, there were 40,942.
A hole in MFA
MFA is among a number of security offerings designed to protect enterprises from cyberthreats and the problem of employees inadvertently clicking on malicious email attachments or URLs designed to steal credentials, including the usernames and passwords needed for single-factor sign-ins. Another authentication factor is needed, ranging from fingerprint or facial recognition to a PIN or an answer to a security question.
There also are push notifications, which are prompts on a user's mobile device if there is an attempt to use their credentials to sign into a system or account. The prompts ask for verification that the user is the one trying to sign in.
[5]
[6]
In an MFA fatigue situation, the attacker uses the stolen credentials to try to sign into an protected account over and over, overwhelming the user with push notifications. The user may initially tap on the prompt saying it isn't them trying to sign in, but eventually they wear down from the spamming and accept it just to stop their phone going off. They may assume it's a temporary glitch or an automated system causing the surge in requests.
An IT department could introduce a policy that blocks the user from logging in, and ending the MFA spam, after a certain number of failed requests, though such a policy may not be possible (depending on the tech involved) or could be exploited to lock out employees as a form of denial-of-service attack. The worker may also accept the request before the limit is reached. But this option may be there for you to consider.
[7]
That said, sometimes the attacker will pose as part of the organization's IT staff, messaging the employee to accept the access attempt.
It's all about human behavior
Like phishing and other attacks, MFA fatigue relies on social engineering to access the corporate network.
"It's an attack method which preys on the employee to be a human," John Spiegel, director of strategy and field CTO for Axis Security, told The Register .
"The intent is to get the victim to become frustrated with countless MFA requests and finally click 'approve.' We've all experienced something similar with technology. Whether it is as simple as programming the clock on a refrigerator or clicking through screens to accept all cookies to get to content we are after, we don't always validate the request. That is what the bad actor is counting on."
Threat groups run with MFA spamming
The attack is relatively simple but it's been working for cyber-crime crews. The Yanluowang gang in May used it in an attack against Cisco and later published some of the stolen data on a dark web leak site. In March, the Lapsus$ group leaked 37GB of source code stolen from Microsoft after compromising an employee via MFA fatigue.
Then there was Uber, which [8]put the blame on Lapsus$.
In a [9]report updated in May, Google-owned Mandiant pointed to a couple of Russian teams using MFA spamming in their attacks. The threat also has caught the government's attention. The US Cybersecurity and Infrastructure Security Agency (CISA) this week posted [10]fact sheets highlighting the threats to MFA and how organizations can protect themselves.
[11]
"It's a huge threat because it bypasses the security measures put in place by an organization, including one of the most effective, which is MFA," Sami Elhini, biometrics specialist at Cerberus Sentinel, told The Register . "Enterprises need to pay attention to this, because like phishing, MFA fatigue is a form of social engineering."
Enterprises relying more on MFA, zero trust
The attacks on MFA come as businesses, with the COVID-19 pandemic lifting, are adopting cloud-first and zero-trust models, which often rely on MFA to protect data and applications, Stephanie Aceves, senior director of products management at Tanium, told The Register .
"MFA fatigue poses a serious threat to organizations because it is a fairly trivial way for a patient attacker to gain access to private company resources," Aceves said, noting that it targets the most significant risk to enterprises – people who can be manipulated.
Given this, what can enterprises do to protect themselves from MFA spamming attacks? As with other forms of social engineering, educating employees about the threat is important but isn't the full and only solution. Ensuring authentication apps can't be fat-fingered and requests accepted before they can be fully evaluated would be handy.
"People have been told they need to get rid of passwords and move to MFA, but they aren't being told that the vast majority of MFA is easily phishable, as easy to steal or bypass as your password," Roger Grimes, data-driven defense analyst for KnowBe4, told The Register . "All MFA users think they are far harder to attack than if they were using a password and this simply is not true."
Because of this, users have not been given the least bit of "education about common types of attacks and how to recognize them, prevent them, and how to appropriately report. Literally, five minutes of education would make a world of difference."
That is to say: entirely relying on MFA isn't going to completely help. You still need to educate users on how to identify phishing so that they don't end their MFA codes or accept requests along with handing other credentials. You also need to architect your systems so that if or when someone does fall for a phish, the security breach is contained as much as possible and is detected as early as possible.
Number matching, request limits can help
Companies such as Microsoft are taking steps, too. Redmond, for instance, is making number matching a [12]default feature in its Authenticator app. This requires a user who responds to an MFA push notification using the tool to type in a number that appears on their device's screen to approve a login. The number will only be sent to users who have been enabled for number matching, according to Microsoft.
They're also adding other features to Authenticator, including showing users what application they're signing into and the location of the device, based on its IP address, that is being used for signing in. If the user is in California but the device is in Europe, that should raise a big red flag.
Duo in August also [13]introduced number matching in its Duo Push app. The feature, which is in early access and called Verified Duo Push, requires users to enter a verification code to "ensure only verified users are able to log in, and prevent someone absent-mindedly accepting a push they did not request," Joshua Terry, product manager at Duo, wrote in a blog post.
Okta also offers organizations what it calls a [14]"number challenge" for push notifications with its Okta Verify tool.
CISA is [15]encouraging organizations to implement anti-MFA-phishing defenses or at least number tools.
"Although number matching is not as strong as phishing-resistant MFA, it is one of the best interim mitigations for organizations who may not immediately be able to implement phishing-resistant MFA," the agency wrote.
[16]Uber explains how it was pwned this month, points finger at Lapsus$ gang
[17]Now Oktapus gets access to some DoorDash customer info via phishing attack
[18]Crooks target top execs on Office 365 with MFA-bypass scheme
[19]This big phish can swim around MFA, says Microsoft Security
As to limiting the number of unsuccessful MFA authentication requests: Okta [20]limits that number to five; [21]Microsoft and [22]Duo offer organizations the ability to implement it in their settings and adjust the number of failed attempts before the user's account is automatically locked. With Microsoft Authenticator, enterprises also can set the number of minutes before an account lockout counter is reset.
"At the end of the day, no model is perfect," Tanium's Aceves said. "As security experts, it is our responsibility to come up with controls and additional layers of defense to prevent attackers from accessing the data and resources we are tasked to protect."
For some, passwordless is the eventual goal
For companies like Microsoft, Google, and Apple, a key step will be to get rid of passwords altogether. All three in May signed onto the common passwordless sign-in [23]standard created by the FIDO Alliance and World Wide Web Consortium for everything from websites to apps and across devices and platforms.
However, broad adoption will take time. There are still legacy systems and applications that don't support password-free authentication, but the eventual goal will be eliminating what has become a key weakness in the cybersecurity chain. Until then, strengthening passwords will continue to be important.
"Not all MFA is equal and cyber-awareness is critical, along with additional security controls such as privileged access management [that] can help reduce these risks, such as moving passwords into the background and ensuring each account has strong unique complex passwords," Joseph Carson, chief security scientist and advisory CISO at Delinea, told The Register . ®
Get our [24]Tech Resources
[1] https://www.theregister.com/2022/09/19/uber_admits_breach/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/09/13/cisco_ransomware_data_leaked/
[4] https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.uber.com/newsroom/security-update
[9] https://www.mandiant.com/resources/blog/russian-targeting-gov-business
[10] https://www.cisa.gov/uscert/ncas/current-activity/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2RICilyfZv-NnKyK3j5AwAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/advanced-microsoft-authenticator-security-features-are-now/ba-p/2365673
[13] https://duo.com/blog/verified-duo-push-makes-mfa-more-secure
[14] https://help.okta.com/oie/en-us/Content/Topics/identity-engine/authenticators/configure-okta-verify-options.htm
[15] https://www.cisa.gov/uscert/ncas/current-activity/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching
[16] https://www.theregister.com/2022/09/19/uber_admits_breach/
[17] https://www.theregister.com/2022/08/26/doordash_oktapus_phishing/
[18] https://www.theregister.com/2022/08/25/microsoft_365_bec/
[19] https://www.theregister.com/2022/07/13/aitm-phishing-microsoft/
[20] https://support.okta.com/help/s/article/When-does-the-MFA-Lockout-Counter-reset?language=en_US
[21] https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#account-lockout
[22] https://help.duo.com/s/article/4963?language=en_US
[23] https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/
[24] https://whitepapers.theregister.com/
Re: Surely there's a design fault here
Michael Hoffmann
Yes, this one threw me: has there been a trend in the move to MFA to turn off auto-lock-after-X-attempts? Why?!
The article then quotes some, vendor I guess?, about the security improvement by limiting the number of attempts.
I can't even...
Re: Surely there's a design fault here
iron
Exactly. Password based systems have locked acounts after multiple failed attempts for decades so why doesn't MFA do the same?
And don't call me shirely
diodesign
"Instead of repeatedly sending out such notifications, surely the system should lock the user out completely after X number of rejections"
Yes, that's discussed in the piece lower down. It's an option. You may not want to use that option as it could lead to a DoS-like scenario against staff but you might instead consider setting a rate limit anyway.
I've made a note of that option higher up in case people don't make it to the end.
C.
Anonymous Coward
>As with other forms of social engineering, educating employees about the threat is important.
Almost entirely nonsense. Educate your employees all you like but in an organisation of thousands or even tens of thousands of people people there's always going to be someone who fucks up. To illustrate this point my employer's security team recently ran an internal phishing campaign. It was good. Like, really, really good. I'm pretty damned competent when it comes to security, and I came *this* close to falling for it. Hundreds of people actually did. In an organisation of only a few thousand, highly-skilled, tech-savvy people who all dutifully comply with their security rules.
Which is why none of us were all that bothered when we were required to obtain YubiKeys, set a passcode and embrace Numbers Challenges from our SSO. If our two internal security guys can successfully phish us, then you can bet the suspiciously well funded definitely-not-Russians working out of Eastern Europe certainly can.
You defeat phishing and social engineering by picking MFA that can't be (reasonably) phished.
Crumbs, why so angry
diodesign
"Almost entirely nonsense"
Well, we said it's important but - as the article goes into - not the only thing to do. Education is good but systems in place to block, contain, and detect are also important. I've made that clearer for people in the piece.
We just had a load of phishing attempts against us too by someone pretending to be our CEO. The attempts failed but we still did a round of internal messaging/education about it afterwards as well as reviewing defenses and operations to make sure everyone's on the same page.
C.
Psychology
Terry 6
It doesn't take a lot of understanding ( and the crooks seem to have it) to realise that if you make accepting rather than denying the easiest option there will be some, perhaps many, who'll eventually just accept so that they can just get on uninterrupted. The marketing departments that stick cookies and stuff on our PCs know this.
Samsung's Smart TV people know this, blocking data slurping is a nightmare- or indeed impossible- because they've made it so time consuming and tedious, if you can even find it. Re-enabling everything you've painfully rejected takes just a moment of inattention. (Bastards)
Surely there's a design fault here
"overwhelming the user with push notifications. The user may initially tap on the prompt saying it isn't them trying to sign in, but eventually they wear down from the spamming and accept it just to stop their phone going off."
Instead of repeatedly sending out such notifications, surely the system should lock the user out completely after X number of rejections, requiring the user to escalate and contact IT/Security to try to gain access, who would hopefully use other measures to verify the identity of the user or determine it was a potential hack attempt.