Protect Your Organisation from the Bad Guys with Multi-Factor Security

In June 2021, the largest ever compilation of stolen passwords (dubbed ‘RockYou2021’) containing 8.4 billion password entries was leaked on a popular hacker forum. The leak is almost 3X larger than the “Compilation of Many Breaches (COMB)” leak, which in February 2021 was then considered the “largest breach of all time”.

Many cybersecurity experts urge organisations to create strong, unique passwords to protect their network, systems, and data. Many extol the virtues of password management software. But even if you deploy password managers, or educate your workforce about the perils of weak passwords; the continued use of password-only authentication systems does not protect your organisation from bad actors. Multi-factor Authentication (MFA) provides a more reliable and efficient way to defend your firm from the bad guys.

Read on to explore the various benefits of multi-factor security.

Multi-factor Security Prevents Cyber Attacks

Unlike password-only authentication (also known as something you know), MFA includes two or more authentication factors. These could be some combination of ‘something you know’, ‘something you have’, and ‘something you are’. These additional factors add extra layers of security to the enterprise infrastructure. They ensure that a user is really who they say they are.

Equally important, multi-factor security prevents bad actors pretending to be legitimate users from getting through the system. This is because even if they manage to access the user’s password, they still need to get through additional fences to successfully hack in.

These advantages are even more crucial now, when so many organisations have adopted remote working models, and are especially vulnerable to remote attacks, and attacks on mobile devices.

Multi-factor Security Mitigates Security Challenges Due to Human Factors and Privileged Insiders

MFA enables the organisation to move away from conventional perimeter-based security to zero-trust security, where a single authentication factor, e.g. a password, is considered inadequate to protect the organisation. This “never trust, always verify” approach ensures that all resources are securely accessed by legitimate users whose access is constantly monitored and controlled. MFA is also effective against malicious insiders using stolen credentials. All in all, MFA is a highly effective method to prevent security challenges due to human factors.

Multi-factor security also minimises the effects of privileged credential theft. With MFA, access to privileged accounts is not controlled by passwords alone, making it difficult for hackers to abuse the legitimate credentials, and carry out malicious activities against the organisation.

Multi-factor Security Protects Against Password-related Threats

Most people use common passwords like “password”, “12345678” or “qwerty” which threat actors can easily guess to hack into enterprise systems. Another issue is that users often reuse the same password across multiple accounts. In 2020, 60% of data breach victims had reused at least one password across multiple platforms. Attackers only have to crack one password to hack into all the systems the legitimate user has access to.

Passwords make the organisation vulnerable in numerous ways, including:

- Brute force and password spraying attacks: The intruder tries multiple passwords to hack into a system, hoping that at least one will work

- Credential stuffing: A large numbers of credentials are automatically entered to fraudulently gain access to user accounts

- Phishing: An attacker sends a malicious email to persuade the user to type their password into an attacker-controlled website

- Keylogger: Malicious software is installed on a user’s device without their knowledge to track their activities, e.g. password entries

Multi-factor Security Strengthens Identity Protection

Account Takeover (ATO) is a form of identity theft where a malicious actor gains access to a user’s account, usually due to weak password “security”. Once in, they may steal enterprise data, send out phishing emails, sell the credentials on the Dark Web (similar to RockYou2021), and even use the stolen information to hack into other accounts within the organisation. The risk of ATO is especially high because attackers can choose from a wide variety of techniques, such as:

- Phishing and spear phishing

- Hacking through brute force attacks and automated scripts

- Botnets

- Credential stuffing

- Social engineering

MFA can prevent such attacks, simply because it doesn’t rely on passwords alone. It can even be used to detect and prevent fraud and illegitimate transactions on-the-fly. Strong, hardware-based cryptographic MFA also ensures the integrity, authenticity and non-repudiation of transactions, while also providing proof of the sender's identity.

Passwordless Zero-trust MFA Keeps Legitimate Users In (And Bad Actors Out)

Passwordless, zero-trust MFA provides strong, tamper-proof authentication and authorisation, since it doesn’t rely on passwords or other remembered secrets. A user’s identity is verified based on a possession or inherent factor, both of which are near-impossible to spoof, steal or compromise.

Passwordless, mobile-based authentication with both possession and biometrics ensures that an entity trying to access a system is who they claim to be, and makes it difficult for a threat actor to compromise the organisation's network and infrastructure.

Conclusion

In the modern cyberthreat landscape, organisations cannot afford to rely on weak password-based authentication. Instead, they must adopt stronger approaches such as multi-factor security and passwordless authentication to secure their infrastructure.

MFA with passwordless is a particularly robust option for modern enterprises since it provides reliable authentication for authorised users, reduces overheads of password management, and also simplifies the user experience.

About the Author

Proudly made in Germany, IDEE’s AuthN™ is a truly passwordless, zero-trust authentication and authorization service for today’s organisations. AuthN by default offers multi-factor authentication which is passwordless and is based on strong factors that balance security, usability and cost. To try next-gen passwordless authentication and authorisation, click here.