REMEMBER - When "Identity is the new perimeter" , MFA combined with Employee awareness can be a good Firewall. There are now upward of 1.5 billion credentials floating in the wild ready for use by malicious miscreants at an exposed service near your data. Akamai saw more than 115 million attempts to use stolen credentials per day, and three times during the year the attacks spiked to more than 250 million attempts per day.

In March, for example, the FBI warned management-software firm Citrix that attackers had breached the company's network using a low-volume credential-stuffing attack

"Nation states actors typically target MSP (managed service providers) and companies like Citrix due to their client base and intellectual property," he said. "Other than espionage or financial profit, MSPs can also be targeted and leveraged in supply chain attacks that are used as a staging point to distribute additional malware."


https://www.darkreading.com/threat-intelligence/credential-stuffing-attacks-behind-30-billion-login-attempts-in-2018/d/d-id/1334371

MFA is a MUST, here is another story to support it - Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012.

The Facebook source said the investigation so far indicates between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees


https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/

Modlishka - A tool that can bypass login protections for accounts protected by two-factor authentication (2FA).

This drives home couple of important points

1. Attacks evolve faster than we can imagine. In December a Iranian group called "Charming Kitten" defeated 2FA and today (less than 40 days) we have a tool that can perform  the same.

2. 2FA is (only) an additional layer of security. It is potent only when it is a part of a comprehensive risk management program.

3. Basic 2FA like OTP via SMS/Email and security questions can be defeated and organizations should be well aware of them.
4. Ultimately, end users are an important layer of defense making awareness training an important part.

https://threatpost.com/2fa-broken-authentication/140776/

Wake-up call to those who still rely on SMS-based authentication and believes it is secure (don't give up, just replace SMS with OTP apps)

According to Reddit, the unknown hacker(s) managed to gain read-only access to some of its systems that contained its users' backup data, source code, internal logs, and other files

According to Slowe, the most significant data contained in the backup was account credentials (usernames and their corresponding salted and hashed passwords), email addresses and all content including private messages.

The hack was accomplished by intercepting SMS messages that were meant to reach Reddit employees with one-time passcodes, eventually circumventing the two-factor authentication (2FA) Reddit had in place attacks.

https://thehackernews.com/2018/08/hack-reddit-account.html

Another reason to use MFA (Multi Factor Authentication) -77% of the FTSE 100 were exposed

If they had enabled Multi Factor Authentication (MFA) then , the RISK associated could have been low/Minimal

77% of the FTSE 100 were exposed with an average of 218 usernames and password stolen, published or sold per company.

A significant number of credentials linked to FTSE 100 organisations were still left compromised over the three months following the discovery.


For More:
https://blog.knowbe4.com/77-of-the-ftse-100-have-compromised-credentials-what-is-your-stolen-password-percentage

Sound Proof - (meaning presenting "Sound" as "proof") for 2nd Factor Authentication method

Interesting idea


From the Article:

Dubbed “Sound-Proof” It will rely on ambient sounds. What happens here is that when you login, both your phone and computer will start listening for ambient sounds. When it determines that both devices are listening to the same thing, it will log you in, meaning that if for some reason the hacker managed to steal your generated code but your smartphone is in a different location, they won’t be able to get in either.

More details on Sound Proof (also has a link to video):
http://sound-proof.ch/

"Selfie" based 2nd factor Authentication?

MasterCard wants to try it

From the article:

MasterCard is launching a facial recognition payment service based on “selfies” taken on a smartphone. This new technology features a photo scanner that creates a map of the shopper’s face, which is then translated into a code for confirmation of future payments.

According to a survey released by Visa Europe, 69 percent of Europeans aged 16-24 believe that their lives will be “faster and easier” without passwords. Contactless payments would be the next natural step, enabling shoppers to complete transactions far more quickly.

However, when it comes to the extensive use of biometrics in the payments industry, the biggest hurdle to overcome is widespread adoption. 

For more info:

http://techcrunch.com/2015/08/09/biometric-security-from-selfies-to-walking-gaits

A chain is only as strong as its weakest link, - You (Example :- JP Morgan) will get hacked even if you spend $250 Million every year

There are two thinks I always remember

1. A chain is only as strong as its weakest link (So, know what you want to protect and then find the the right method (simple is always best) to protect it)
2. Security is Part philosophy (Sometimes what you think and believe may not be the best method of protection so, listen well and adapt quickly)

From the Article

Big corporations like JPMorgan spend millions — $250 million in the bank’s case — on computer security every year to guard against increasingly sophisticated attacks like the one on Sony Pictures. But the weak spot at JPMorgan appears to have been a very basic one.

JPMorgan’s security team had apparently neglected to upgrade one of its network servers with the dual password scheme (2 Factor) , the people briefed on the matter said. That left the bank vulnerable to intrusion.

Follow this link for additional details:

http://dealbook.nytimes.com/2014/12/22/entry-point-of-jpmorgan-data-breach-is-identified/?_r=0