GitHub's MFA Plans Should Spur Rest of Industry to Raise the Bar

GitHub recently made security news by announcing plans to implement default multifactor authentication (MFA) across its repositories. The company deserves credit for recognizing its gravitational pull within the software ecosystem and acting accordingly, but it shouldn't be alone. We as industry leaders should be building on what individual platforms like GitHub are doing in two critical ways: demanding our own ecosystems of providers raise the bar of their security practices, and creating more interoperable architectures and blueprints to make better security postures more accessible for organizations that rely on our critical platforms.

Our Interconnected Tech Stack

Enterprises today rely on a whole ecosystem to run their tech stacks. They rely on cloud services for their infrastructure, including Azure, AWS, and Google Cloud. They rely on companies like Okta for their identity solutions, and they rely on a whole host of technologies to help them build or sell products faster, including collaboration and CRM apps as well as repositories like GitHub.

They also rely on a broad set of third-party providers to deliver services such as customer support, or to manage some aspects of their infrastructure. We know the long chain of software cooks in the kitchen has created access nightmares and breaches. The Cybersecurity and Infrastructure Security Agency, along with other international government security organizations recently released guidance for managed service providers, and third-party risk is something we at Okta know better than most. In January of this year, we experienced the compromise of a provider that ultimately resulted in a threat actor briefly gaining access to an Okta support tool via a thin client. While the threat actor never directly accessed the Okta service through an Okta account, Okta's own security posture was threatened as a result of our interconnected ecosystem.

The Path Forward

The first step toward resolution is technology leaders looking internally to recognize and take stock of our own service supply chain and the third-party providers we rely on. In Okta's case, we took a hard look at how Okta provides access to our providers and the security expectations we have for third-party providers that have access to customer data. While security practitioners understand the need to implement systems of least privilege that limit lateral movement, it's critical to ask whether those same principles are being applied by the third-party providers you rely on. Movement within their environments can become movement in yours.

The second area is looking outward toward the customers and partners who rely on our platforms. In the case of GitHub, the attack surface is massive and the user base is broad. In an age where everyone acknowledges the need to implement MFA, its adoption levels are still quite low. Look no further than Microsoft Azure Active Directory, where more than three-quarters (78%) of organizations currently don't employ MFA for their user accounts according to Microsoft's "Cyber Signals Report."

For something like identity and access management, it's easy to see just how broad the identity and access management attack surface can be. According to Verizon's "Data Breach Investigations Report," 89% of Web app attacks are caused by credential abuse. While standards help a lot in access management, they are not foolproof. Leading identity solutions have largely eliminated the need for individual configurations to apps and services through prebuilt, self-service integrations that rely on standards and protocols like SAML and OpenID Connect.

But that ability to ensure secure interoperability can and should go further.

Organizations rely on multiple solutions that co-exist, feeding logs, risk signals, and other valuable insights into one another. We often think of this for security tools, but it should also apply to any platform or service where there is data and sensitive information. This is where we can and should improve in order to raise all security boats. Our efforts as an industry to operate with an eye toward open, prebuilt integrations and clear architectures will ensure that tentpole technologies — whether they're in networking, identity management, endpoint detection and response, or security information and event management — work effectively together. This goes beyond preventing misconfigurations: It's about creating better security outcomes.

Our technology world is flatter today than it has ever been before, whether it's our collective reliance on third-party providers, our interconnected software supply chain, or the interoperability of our tooling. In that environment, it's critical for industry leaders to not only maintain a high degree of compliance across their own ecosystems of third-party providers but to develop technologies and policies that raise the bar for their users and customers. Part of that is through steps like the one GitHub is taking: implementing default policies that rely on stronger factors. But in an interconnected world, we must move beyond individual actions to create open and interoperable technologies that enable users to easily configure and integrate their foundational technologies in secure ways.