Identity Alone Won't Save Us: The TSA Paradigm and MGM's Hack

The recent cyberattack against MGM Resorts grabbed headlines and sent shockwaves across the industry. The hotel and entertainment giant struggled to get systems back online after widespread outages affected several of its landmark Las Vegas properties. In addition to outages of internal networks, the hack also affected slot machines, ATMs, digital room key cards, and electronic payment systems.

Much of the reporting on the incident focused on how the casino's seemingly impenetrable security was infiltrated by teenaged attackers affiliated with ransomware group Scattered Spider. To those of us in the cybersecurity industry, the attack called attention to one of the most important and difficult challenges: properly understanding and managing access and authentication controls.

The hack of MGM Resorts began with a vishing (voice phishing) breach of the company's IT help desk. By impersonating employees and requesting access to their accounts over the phone, the attackers were able to sidestep end-user verification and deploy a ransomware attack after gaining administrator rights. Many analysts have become fixated on the idea that MGM could have prevented the incident if only it had been using better identity solutions or stronger methods of verifying user identities.

However, this is incongruous with the facts.

More Identity Verification Isn't the Answer

The hackers gained access through social engineering. Simply adding more identity products to a growing pile of security solutions is not the answer — and suggests a widespread misunderstanding of authorization and access controls. While protecting identity is a critical fight in the modern cyber landscape, the reality is that identity products alone would not have prevented this attack. Organizations need to instead emphasize proper authentication and access controls alongside identity.

We often utilize identity providers who create, store, and manage digital identities, ensuring that a user is who they say they are when they log onto a network. However, as evidenced by the MGM cyberattack, threat actors can bypass these providers and compromise legitimate identities, granting them undue access to an organization's environment.

We Need to Secure IT Like We Secure Airplanes

Drawing an analogy from airport security offers an enlightening perspective on where MGM, and many others, might be going wrong. Consider an airport. Here, the primary assets — the airplanes — are shielded from threats like bombs and weapons. The plane, much like a server in an organization, is the sensitive resource. At the airport, stringent security checkpoints ensure there's no direct access to these airplanes without thorough vetting. Similarly, in a well-secured enterprise, a robust security checkpoint (or a policy enforcement point) should stand as a guardian in front of servers, ensuring no direct access without rigorous checks.

The TSA's three-step protocol offers a compelling analogy:

This airport protocol can be translated to the enterprise digital realm:

MGM's shortcoming? While it performed the first step — identity verification — it overlooked the critical subsequent phases. The notion that merely amplifying identity products could rectify such breaches is fundamentally flawed. It's analogous to an airport ramping up ID checks but neglecting baggage scanning, naively believing this will prevent harmful items from making their way to planes.

A Better Approach to Authorization and Access

In order to implement better authorization and access controls within your organization, following the NIST 800-207 Zero Trust Architecture model, which states that per-request access decisions must be enforced to prevent unauthorized access to systems and services, is the core to preventing breaches. Replacing legacy technology — like VPNs, VDIs, and on-premises proxies — with a zero trust secure access service edge solution provides greater access and authorization controls and inspects requests every single time. It is critical to also implement standardized, multifactor authentication alongside passwords for better control over identification.

The MGM cyberattack has revealed one of the critical cybersecurity challenges that modern organizations face. To secure our digital landscapes against increasingly sophisticated threats, we must update legacy technologies and move toward a zero-trust approach, one that mirrors the comprehensive, multilayered security we see at our airports. As an industry, we need to vastly improve the way we approach authorization and access controls to combat sophisticated threats.