A real-life example highlighting the importance of using MFA to help avoid breaches and reputational damage
Multifactor authentication (MFA) is a security feature that requires users to provide more than one piece of evidence to verify their identity when they sign into their Microsoft Entra tenants. MFA can help prevent unauthorized access to your accounts, data, and resources, even if someone steals or guesses your password.
Unfortunately, not all Microsoft Entra customers have enabled MFA in their tenants, and this can have serious consequences. In this blog post, we’ll share a recent incident where a company reached out to us after suffering a security breach because they didn’t have MFA enabled on a high-risk account.
What happened?
In this situation, the company had a high-risk account that was used by the Finance Director to send and receive important emails. The organization didn’t have MFA enabled on the account, which means that anyone who knew or guessed the password could sign in without any additional verification. Unfortunately, a malicious actor was able to do just that, and gained account access.
The malicious actor then used the account to send emails under the Director’s identity. These emails contained false and misleading information such as customer invoices containing malicious URLs. The emails were sent to various employees, customers, and partners.
To cover their tracks, the malicious actor created mail rules in the Director’s Outlook to hide incoming emails and replies. In this way, the malicious actor delayed the user from finding out that they had been compromised.
The impact of not using MFA
As a result of the breach, the company suffered reputational damage and had to spend valuable time and resources to investigate the incident, restore the account, and communicate the resolution to stakeholders.
The company could have avoided this situation if MFA had been enabled on the high-risk account. MFA would then have prevented the malicious actor from signing in, even if they had the password. MFA would have also alerted the user that someone was trying to access their account and prompted them to change their password.
Upcoming MFA changes in Microsoft Entra
As part of the Secure Future Initiative, Microsoft has begun rolling out mandatory MFA policies to their tenants and will begin enforcing certain levels of MFA in customer tenants in July of 2024. While these policies will not be enforcing MFA for regular users, they will require MFA for anyone performing functions within the Microsoft administrator portals or via PowerShell.
Conclusion
MFA is a crucial security feature that can help protect your Microsoft Entra tenants from unauthorized access and security breaches. It can also help you comply with security standards and best practices.
If you haven’t already, we recommend enabling MFA in your Microsoft Entra tenants as soon as possible and educating your users on its importance.
If you need any assistance or have any questions, please reach out to Inviso. Our experts will guide you through implementation of MFA with our proven security maturity framework. A great starting point is our AI security & governance.
