The Myths of Multifactor Authentication

Compromised credentials are a huge threat to companies today. Why? The attacker is actually using valid (that is, stolen but valid) credentials, so why would your antivirus, firewall, and other technologies you might have in place flag anything unusual? Your tools assume people accessing your network are who they say they are.

This threat is now well known among organizations, but many of them still are not doing what needs to be done about password security. A couple of years ago, we surveyed 500 IT security managers in the US and UK, and the results showed that only 38% of organizations use multifactor authentication (MFA) to better secure network credentials. Sadly, more recent research shows that things haven’t changed much.

Why Are Organizations Reluctant to Adopt MFA?
Here are some myths that plague MFA:

Only large enterprises should use MFA.
This is a common misconception. Many organizations believe that a company needs to be a certain size to be able to benefit from MFA. They’re wrong. Using MFA should be a key security measure for any company, regardless of size. The data to protect is as sensitive and the disruption as serious in any company. And using MFA doesn't have to be complex, costly, or frustrating.  

MFA should only be used to protect privileged users.
Wrong again. In most organizations, most employees are considered to have access to valuable data, so they rely only on local Windows credentials. It seems a bit exaggerated to require them to use MFA to log in. But it's not. Those "nonprivileged" employees actually have access to data that can be harmful to the company. For example, let's take a nurse who could sell a celebrity patient's data to a newspaper. This shows the value of data and the possible harm that can come from it being inappropriately used.

But that's not all. Cybercriminals usually don't start with a privileged account; they take advantage of any account that falls victim to phishing scams to then laterally move within the network in order to find, access, and exfiltrate valuable data.

MFA is not perfect.
OK, no security solution is perfect — but MFA is close. As you may have heard, the FBI issued a warning recently regarding situations where cybercriminals were able to bypass MFA. There were two main authenticator vulnerabilities: "channel jacking," involving taking over the communication channel that is used for the authenticator, ⁠and "real-time phishing," ⁠which uses a machine-in-the-middle that intercepts and replays authentication messages. According to experts, such attack types require considerable costs and effort. Most hackers who encounter MFA prefer to move on to their next (easier) victim than trying to bypass this security measure. You can also take simple precautions to avoid some vulnerabilities, such as choosing MFA authenticators that don't rely upon SMS authentication. (The National Institute of Standards and Technology discourages SMS and voice in its latest Digital Identity Guidelines).

Despite recent events, the FBI affirms that MFA is still effective and that it's one of the simplest steps an organization can take to improve security.

MFA disrupts users' productivity.
It doesn't have to. With new technology, there is always the same challenge: implementing it in a way that least disrupts employees' productivity. If it's too disruptive, users will find a way to circumvent security controls. Without this sensitivity, adoption can slow or even stop. Therefore, MFA requires flexibility. Administrators may want to avoid prompting users for MFA each time they log in. That's why MFA should be customized according to each company’s needs.

Anyone can be victim of compromised credentials — whether you are a privileged or nonprivileged user. Using MFA should be a key security measure for any company, regardless of size, and can be one of the easiest ways to keep accounts secured.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Account Fraud Harder to Detect as Criminals Move from Bots to 'Sweat Shops'"