Multi-factor authentication

Okay, let's break down session cookies because this is crucial.

When you log into your email, you enter your password and maybe you type in an MFA code from your phone.

Right.

Once you do that, the website puts a temporary file, a session cookie, on your browser that says, yes, this person is fully verified.

It is the ultimate skeleton key.

If an attacker steals that specific session cookie and loads it into their own browser, the website just thinks the attacker is you.

It doesn't ask for a password or trigger an MFA prompt to your phone.

Right.

And if you haven't, compliance debt kind of rides on top of that.

If you haven't been doing and staying up to speed with technology and the changes that are occurring, so things like MFA is a good example.

You know, MFA is a...

And I'm going to interrupt you.

Multi-factor authentication, right? Yes, correct.

And then if it's just that section, like, is that in the cloud? Is it not in the cloud? I got to unplug this thing and plug it back in.

And then...

Whenever we do MFA, that multi-factor authentication, like what's the process to make that easy for people? Because then you have like a whole nother, like, are we doing text messages to manage this or how is that going to actually work? So any, any thoughts for me there?

Yeah, but it's still a breach of security, arguably.

Like, if you're not using MFA, I think there is an argument to say, well, there is a breach of security, plainly, because you've not got sufficient technical and organisational controls in place.

I mean, that is very much the advanced computing care notes point.

They had 95% of their users using MFA, but it was just the 5% of trust users that didn't.

But what if that 5% have opted out of using MFA?

And this is where I think the ICO didn't really thoroughly invest this properly.

So investigate this sufficiently.

CareNotes, Advanced Computing.

Right.

I mean, they could conceivably going right past MFA.

That's right.

You know what's happening.

What do you see? I mean, is that is that more and more common? What do you see? That is the

ideal approach, because, I mean, if you think about our traditional offenses with MFA, everybody just thought we put an MFA and then we're safe from this type of.

activity and the session cookie is worth way more on the market than username and password just because you're bypassing all those controls and leveraging that.

That is one of the primary ways and probably the most valuable token that's out there that you can have access to as an attacker.

not that we're not using it in other ways like meeting minutes and you know uh you know using you know power automate or whatever for some generic workflows right to to increase things and stuff like that but um but My challenges more right now have been on securing foundational principles.

Like we came in, we didn't have MFA.

I'm like, how can the company not have MFA? And, you know, so like foundational principles like implementing MFA right now are stuff that I'm more focused on because I think that's more of a concern.

than me getting AI tools out there.

I need to secure the data.

Yeah.

And it's like, oh, and then it's like, it takes a look at your, I don't know, Microsoft, you know, your 365.

I was like, did you know you don't have MFA set? Like, oh yeah.

I don't even care.

Yeah, and you think you're safe with MFA, but I mean, this thing bypassed MFA and like people would change their MFA and within 12 minutes, hackers could get in and take over their account and change their MFA again so that they can, you know, the original person can get back in.

It's just wild.

But I guess the caution that some of the security experts were given to companies and I guess individuals as well was, Don't just depend on 2FA, have some better security practices.

Do you?

I have no app that would give.

Have they invented anything that's better than 2FA or MFA? No.

Unless he's pass keys that are, I mean, I'm logging onto a bunch of websites now that are saying, do you want to save the pass key that kind of bypasses an extra layer of security? And, uh, yeah, I don't know if that's better or not.

Yeah, they've come back.

And then one more trick slash tip is enable MFA.

And then these fraudsters are generally not using a multi-factor authentication fish kits or attacker in the middle fish kits or device code phishing to add malicious apps to your N365 instance.

They're typically just aiming for usernames and passwords.

Untra Private Access, conversely, creates a secure encrypted tunnel only to the specific IP address and port required by that single accounting application.

And it only establishes that tunnel after Untra ID evaluates the user's identity, the MFA status, and the Intune compliance state of their device.

Wow.

This convergence of optimized direct internet routing via SD-WAN paired with identity-aware micro-segmented access controls is what the industry has packaged into the SASE architecture secure access service edge.

So the human still has control in those situations.

So yeah, you need those authentication, MFA and MAV to verify.

And then you have an admin who watches for all of that.

And that admin gets alerted.