Multi-factor Authentication (MFA)

Best practices and resources to help your organization implement multi-factor authentication

What is Multi-factor Authentication?

Multi-factor Authentication (MFA) is an authentication method that requires the user to provide two or more credentials in order to gain access to an account. Rather than just asking for a username and password, MFA requires one or more additional verification factors, which decreases the likelihood of a threat actor taking over an account.

Credentials may include:

• Things you know (a password or personal PIN)

• Things you have (a badge or cellphone)

• Things you are (biometric information such as fingerprints or facial recognition)

Picture yourself at an ATM withdrawing money from your bank account. Your debit card (something you have) is one authentication factor. However, to access your account, you also need to enter the PIN that is associated with your debit card. Your PIN (something you know) is your second authentication factor.

Another common example nowadays is with access controls for online banking. In order to log into your online bank account from a new device, you must provide your username and password (something you know) along with another factor, such as a one-time passcode on an authentication app on your cell phone (something you have). As cellphones incorporate biometric information, facial recognition (something you are) may be that additional factor.

Modern MFA does not include static authentication methods such as; certificates or pre-shared keys (PSK). 

Pro-tip: The recommended MFA solution has a unique code for each use and is individual to you as a user.

Why is it important for cyber security?

Account takeovers have accounted for 81 percent of data breaches in recent years. There are limits to what a single password can do. Rather than asking for a single password that hackers and cyber criminals can gain access to, this adds an additional layer of security. MFA helps protect against unauthorized access, data breaches and password-based cyber-attacks.

Where should MFA be implemented?

At Corvus, we require MFA implementation for remote access, email access, and administrative access. We like to see that companies have secured any remote access points to their data or systems with MFA, as well as the use of privileged accounts internally, such as domain admins. We’ll detail the specifics below: 

1. Email Access

   • Whether you use on-premise email servers or cloud hosted email servers, MFA is a must to protect against unauthorized access. Threat actors commonly target user credentials to then login to their email accounts and gain full control of that user’s email.

2. Remote Access

   • In simple terms, this is anything that allows access into your internal environment or access to SaaS-based applications that store PII, PHI, or any critical information. Some examples include: RDP, VPN, messaging apps, or your HR software. Threat actors will commonly scan for remote access technologies to login with stolen credentials or brute force accounts with weak passwords.

3. Administrative Accounts

   • MFA is not just for external access. MFA should also be implemented for administrator account usage inside of your network. Administrative accounts, or privileged accounts, are accounts that give full access to a system like local administrator accounts and domain administrator accounts -- these are the accounts that threat actors target so protecting them is critical. MFA for administrative accounts is typically enforced for interactive logons such as RDP or terminal connections like SSH. 
   • If your organization uses service accounts to manage systems, MFA will not be applicable there (as there are no interactive logins). However, we do recommend that there are other cybersecurity best practices, such as leveraging a Privileged Account Management (PAM) solution to manage those, and all, privileged accounts.

Some Factors are Stronger than Others

Cybersecurity professionals have long advocated that two-factor authentication utilizing text messages (SMS) is less secure than other methods. The US government stopped using SMS authentication in 2016 — and encouraged others to do the same. Since then, there have been successful breaches across organizations that still utilize this less secure variation of MFA.   

There are countless ways for criminals to bypass SMS authentication, some more complex than others, but opt for utilizing MFA apps like Duo and Google Authentication if you’re using a smartphone as a means to enable MFA for your organization. 

Another example is key or certificate based authentication in which a digital certificate installed on a laptop or a “key” is placed on a system. While these can be used with a password, they remain static and can be exported from the system and used on attacker controlled devices.

MFA is Not the End-All-Be-All

MFA is an important preventive measure to take to avoid security breaches, but it is not an all-encompassing solution to protect an organization. As noted above, there are weaknesses with SMS-based authentication — and even the most secure forms of MFA have limitations.

For example, if an employee’s personal computer was already compromised and they were utilizing a VPN to work from home, MFA may not prevent malware spreading throughout the corporate network. Additional external and internal defenses would be necessary for further risk mitigation.

The Price of Implementing MFA

While cost can be what holds some back from adding further security measures, MFA is an affordable option to further protect your organization. Notably, through O365 and Google Workspace, there are no additional costs to implement multi-factor authentication. For smaller organizations with fewer users, this is a great starting point. As you grow, you may want to unlock additional features and moving to an enterprise solution such as DUO or Okta is a great next step and unlocks additional security and monitoring features.

MFA Authentication Methods

What resources are available to help policyholders implement MFA?

For email, major email providers like Microsoft 365 and Google Gmail have a free MFA solution, regardless of the subscription level purchased.  

• Microsoft 360 Customers  
• GSuite Customers

Enterprise MFA solutions, such as DUO or Okta, allow organizations additional controls and features for a paid plan.

For remote access and cloud, first determine whether the remote access solution or cloud provider has integrates with the free solutions offered through Microsoft or GSuite.  If not, they will need to identify an MFA tool that integrates with their software or hardware, such as DUO or Okta. Most cloud software supports a free MFA solution that just need to be turned on, especially software being used to store sensitive data (such as Electronic Medical Records software and HR software). Integration with enterprise MFA solutions will be dependent on the cloud provider’s ability to integrate with other technologies.

For administrator accounts, you should determine if there are any free MFA solutions available for the admin credentials.  This however is less likely, especially if they are a hybrid, on- premise and cloud environment, and they may need to identify an MFA solution such as DUO or Okta. Some solutions can integrate directly into Active Directory to support enterprise wide MFA for administrator accounts. For environments with fewer systems, MFA can be enforced on a system by system basis.

Links in this Article & Additional Resources

Corvus MFA Tip Sheet

The Importance of MFA (Tetra Defense)

Not all Two-Factor Authentication is Created Equal (LMG Security)

Microsoft Office 365 Security Best Practices to Protect Your Organization (LMG Security)

The Importance of Multi Factor Authentication in Cybersecurity (Veridium)

MFA Best Practices (Centrify) 

Looking for hands-on help with MFA implementation? Our consults with blue-chip vendors can help. 

Corvus policyholders can access support services through the Vendor Marketplace in their Policyholder Dashboard.

Brokers, request a Security Controls Consult.