There are many companies that are daily affected by security breaches that cause the theft, kidnapping and destruction of confidential information. All these gaps tend to have a common origin: compromised user passwords.
In many cases (more than 52%), these gaps are the result of human error (users using the same passwords they use when registering on certain websites, opening emails requesting to log in to a fraudulent form, using passwords simple, etc ..).
Indeed, password theft is becoming very common and highlights the importance of protecting the user’s identity beyond their password, as it will eventually end up compromised. Clearly, an account protected only by a password is an easy target for attackers.
Not all victims remain anonymous
Recently a news item has been published in the media about the identity theft attack (phishing) that the municipal urban transport company of Valencia (EMT) has suffered. In this case, the “hackers” sent emails on behalf of a company manager to the head of administration in which they ordered the payment of various financial operations worth 4 million euros and unfortunately the employee trusted by making these payments. These types of scams are becoming more and more relevant among companies that do not protect themselves adequately but do not come to light for obvious reasons (shame). In this case, the company is public and for that reason it has appeared in the media, although in effect, from Softeng we are seeing clients who have not yet committed to protecting themselves, suffering similar cases.
How can you prevent something similar from happening in your company?
The solution
You can help prevent some of the identity attacks by adopting a strategy of training your employees to protect against phishing, but what will really help you is that it is practically irrelevant if your password is stolen, adding an additional step to authenticate.
Two-step authentication (called MFA ) provides an additional layer of security to your company, being an access control method that allows you to confirm the identity of a user to prove that they are who they say they are. It works by requesting two, or more, of the following methods of authentication:
- An item you know (usually a password or pin).
- An item you have (a trusted device, such as a mobile phone or digital key).
- A biometric characteristic that identifies you (a fingerprint or your face).
- An App on your device, protected, that allows the user to authorize access.
With the use of various factors to verify the identity of a user, the vast majority of password theft attacks are neutralized since their work is multiplied exponentially as they need to “hack” more than one system at the same time to gain access.
Two-step authentication is very easy to use and includes the ability to configure trusted locations (branches, headquarters, …) for greater security and user convenience.
Recommendation
The usual advice about changing your passwords often or making your passwords difficult, really does not help against the millions of attacks that are suffered daily (more than 300 million fraudulent login attempts directed at cloud services from Microsoft). The idea is, if your password hasn’t been stolen from you, why change it? Or … if a hacker already has your password and you don’t know it, why wait 2 months to change it?
According to studies, multi-factor authentication solutions block 99.9% of these unauthorized login attempts .
Don’t you think the time has come to incorporate it into your company?
How can you have two-step authentication?
This feature is included in the Azure Active Directory Premium subscription and in the packages that it contains: A solution that, in addition to helping to guarantee access to applications and data only to people who really are who they say they are, includes the ability to apply smarter restrictions through three key features:
- Conditional access : To limit access to applications from outside the company (based on group membership, geographic location and device status).
- Identity protection: Risk-based conditional access. For this, strange behaviors are analyzed (for example, you have logged in from very far locations in an impossible time, you try to access from a computer not managed by the organization and others).
- Management of privileged identities: Administration and protection of administrator accounts, allowing to assign the administrator role to a user temporarily, alerting the change and supervising their access to resources.
If you wish, see all the details of Azure Active Directory Premium
Ultimately, hackers have more and more methods at their disposal to obtain user credentials and, in most cases, they will end up obtaining it.
Do you want to know more about how to protect the identity of your users? Contact us!