Welcome to the inaugural blog for the “When in Doubt Reboot” podcast. The purpose of this multi-format IT informational is just that: to inform.  In tandem with the podcast, this blog will help demystify the world of information technology through real-world experiences and examples.

LISTEN TO THE PODCAST HERE

My name is Art Pugach, and I am the Global Chief Technology Officer of Queue Associates. I have nearly 30 years of professional experience in information technology and have been involved with computers in one form or another since my childhood.

Today’s IT informational is titled:

“When in Doubt… MFA.”

The best place to start is by discussing what MFA is and what MFA is not. MFA is one of many three-letter acronyms or TLAs utilized in the information technology (IT) profession and stands for Multifactor Authentication. It is also alternatively known as “push” authentication, where a message is pushed (that is, sent) to an end user’s device whenever the end user signs into his/her/their account. The message’s purpose is to confirm that the user signing into the account is the actual user of the account, and here is why that is important.

The Internet.

That is the short answer. The long answer is that any device connected to the internet or, more accurately, a network, particularly one with access to the public internet, is vulnerable to IT bad actors.  Bad actors in IT will steal, leverage, and encrypt information, whether a single end user, a group of users, a corporation, or a government, etc.

Think of IT bad actors as high-tech burglars. What is the first thing one does to protect one’s house from a break-in? Lock the door. Door locks are great, are they not? They give one total peace of mind, are unpickable, cannot be kicked in, and prevent windows from being broken. Okay, so door locks may not be the total solution.

Think of a password like a door lock. It’s a great first line of defense, but it’s only part of what is needed to protect information. For a house, one gets an alarm. For information, one gets MFA. And that is what MFA, at its core, acts like–an alarm. An alarm is raised when a burglar tries to get into one’s house. An MFA alarm is raised when an IT bad actor tries to get at one’s information.

Passwords utilizing MFA make for a more complete solution. Not a total solution. There is no such thing as a total solution, but here are some things to be aware of with passwords and MFA to get one as close as possible.

For passwords, use long ones. They do not always need to be complex, but the longer they are, the better. The rule of thumb used to be eight, then sixteen, and now, twenty or more characters. The current industry advice is to use passphrases such as the thirty-four character: Susie$ellsSeaSh3llsbythe$3aShore!

In practice, using a passphrase with personal meaning will be harder to hack, such as the fifty-two characters: ArthasgreatITcred!HeattendedAtariComputerCampin1983

The key is the longer the password, the better. Do not forget to throw in some random capitals, numbers, and special character replacements for extra peace of mind.

The only caveat is some sites do not allow characters or passwords longer than 16 characters. Due to this limitation, it is always best to rotate passphrases often and not repeat them. Reusing passwords and passphrases means multiple will be compromised if an IT bad actor gets one of them.

A secure and encrypted digital locker is a must to keep track of passwords and passphrases. LastPass and others make such software. I will not recommend one over another but will say do not go for a free one, as if the free locker is hacked, there will be no recourse or remediation.

For MFA, always enable it when a site allows this. Some sites do not utilize MFA and only utilize passwords. Be careful, especially when using an e-commerce site. If the site does not offer MFA, consider using another vendor.

If there is an option to use an MFA application (such as Microsoft or Google Authenticator), it is preferable over receiving text messages. Unfortunately, text messages can be easily spoofed or faked and used by IT bad actors to get around MFA.

For this reason, several large companies, including Microsoft and American Express, have recently begun eliminating text alerts.

One additional item to note is that some MFA applications allow for fingerprint or face scanning as an extra form of protection. If available, use these, as they are even better than passwords and are personal to you alone.

As an IT professional, IT bad actors will inevitably find a way to get an end user’s password. One of the most common ways is to send a spoofing e-mail. A spoofing e-mail claims to be from a specific person but is actually from a bad IT actor.

I have had this happen on rare occasions to end users I work with, and if it were not for MFA, things would have been much worse.

What happens in a typical spoofing attack is an end user receives an e-mail claiming to be from an admin stating there is an issue with their account. When they click the link in the e-mail (NEVER CLICK ON LINKS IN E-MAIL), it takes them to what appears to be a legitimate sign-in page. The end user signs in and confirms whatever the “admin” asked them to confirm, and that is that. Only it is not.

What happened was that the IT bad actor obtained the end user’s password and then tried to sign in with the account information provided.  No MFA means the door is unlocked, no alarm sounds, and information is easily accessible. Having MFA means the end user gets an alert asking for additional information to allow them to sign in. Upon seeing this alert, the end user will typically alert their actual IT admin that something funny is going on with their account, as they did not sign in anywhere, and the admin will advise the end user to change their password immediately. The end user changes the password, and all the information is protected again, or is it?

Remember when I said a password and MFA are not total solutions?

Here is why. What if the end-user is spoofed again? What if the end-user blindly accepts the push?

This is where other tools come in handy. One is the good old spam filter or the anti-spam filter. Microsoft 365 includes one out-of-the-box, but there are supplementary ones that can be used as well. The better the filtering, the less likely a spoof is to be successful. In addition, allowing the end-user to report suspected spoofing e-mails via Outlook or another e-mail application will help the anti-spam filter learn which e-mails are safe and which are not.

Another great tool is end-user login monitoring. Azure Active Directory (recently renamed Microsoft Entra ID), the backbone to all Microsoft Cloud offerings, including Microsoft 365, Dynamics 365, and, of course, Azure and related services, by default will monitor suspicious logins and alert admins.

Entra ID can be accessed via the following URL: My Dashboard – Microsoft Entra admin center

On this page are tools to protect end users and manage identity protection:

For e-mail protection, the Microsoft Security Center (also known as Microsoft 365 Defender) can be accessed via the following URL: https://security.microsoft.com/homepage

One more item I will highlight before signing off is end-user training. The best way to prevent an IT bad actor from gaining access to information via an end-user account is to educate end users on defending themselves from an attack.

This informational is one way, but Microsoft provides a more direct way as well via their Attack Simulator (which can be accessed via the following URL: https://security.microsoft.com/attacksimulator):

Using attack simulation, an admin can simulate an attack (spoofing or otherwise) and see how the end users respond. After evaluating the response, additional training can be provided on a user-by-user basis, depending on how each end user responds to the simulated attack. This is an incredibly useful tool and will not only prevent attacks in the future but also educate end-users on what attacks IT bad actors may use next.

Queue Associates uses these tools and others to keep our end users safe from attack.  Again, no system is perfect, but being proactive regarding security is always the best practice.