The post What is Passwordless Authentication? appeared first on MODIVA.

MFA extends beyond traditional username and password combinations, offering an additional layer of security to ascertain the user’s identity. The ultimate objective of MFA is to bolster security by introducing complexity, making it considerably more challenging for unauthorized individuals to gain access, even if they’ve compromised or guessed the user’s password. 

How Multifactor-Authentication (MFA) Works 

Once Multifactor-Authentication (MFA) is enabled, the user encounters a second authentication step after logging in with their username and password. This second layer of authentication may involve a number-matching process, requiring the user to enter a matching PIN. Users can receive this PIN via SMS or email, an authenticator app like Microsoft Authenticator (Include a backlink if available) or by utilizing biometric data, such as fingerprint or facial recognition. Authenticator apps generate time-sensitive codes, ensuring that the code provided remains valid for only a brief window, making it extremely difficult for attackers to crack. 

Understanding MFA Fatigue: 

MFA fatigue attacks, also known as push spam, prompt spam, or authentication bombing, represent a relatively unsophisticated hacking technique that exploits a significant vulnerability—the human factor. Once a malicious actor acquires a victim’s credentials, they initiate a barrage of push notifications to the victim’s mobile device, incessantly requesting sign-in approval. The attacker’s aim is to overwhelm the victim, leading them to approve a prompt out of sheer frustration, subsequently granting access to the resources protected by MFA. 

To break down the workings of MFA fatigue attacks: 

• The threat actor obtains credentials through social engineering or theft. 
• The threat actor enters the credentials and sends an MFA prompt to the unsuspecting user. 

• If the user doesn’t immediately accept the prompt, the threat actor sends repeated prompts, inducing “fatigue.” 
• Once the user accepts the prompt, the threat actor gains access to all applications and assets beyond that access point. 

Preventing MFA Fatigue Attacks 

Both organizations and individual users can take proactive steps to avoid falling victim to MFA fatigue attacks. Build consistent cybersecurity practice to stay one step ahead of these sophisticated threats. 

• Maintain Suspicion: If you receive unsolicited MFA notifications, especially during odd hours or from unusual locations, exercise caution and avoid responding to them. 

• Implement Threshold Limits: Organizations can set limits on the number of MFA requests per user within a specified time frame to prevent prompt bombardment and deter attackers. 
• Opt for Number Matching Authentication: Choose MFA methods that require users to select the correct number for authentication, rather than providing a simple “allow” or “deny” option in push messages. 
• Use Unique Passwords: Avoid using identical passwords across multiple platforms to minimize the damage that could result from a compromised credential. 
• Enhance User Awareness: Educate users about the existence and tactics of MFA fatigue attacks. Informed users are more likely to recognize suspicious activity and respond appropriately. 
• Employ Proactive Cybersecurity Measures: While preventing MFA fatigue attacks entirely may not be feasible due to their reliance on human error, sophisticated cybersecurity technology can help detect and thwart suspicious behavior, allowing quick action to stop threat actors from causing further damage to your network. 

In a digital landscape where the balance of power between cybersecurity and cyber threats is ever-shifting, comprehending the nuances of MFA and employing vigilant measures are key to safeguarding your network and critical data. 

The post MFA Fatigue Attacks: How to Safeguard Your Data and Network appeared first on MODIVA.

In the ever-evolving landscape of cybersecurity, few topics have gained as much prominence as Identity and Access Management (IAM). It’s a term that frequently appears in discussions about data breaches, compliance, and the protection of sensitive information. Yet, despite its critical role, IAM often remains shrouded in complexity, leaving many wondering: What exactly is Identity and Access Management, and why is it so essential in today’s digital world? 

Identity and Access Management (IAM) is a framework of business processes, policies, and technologies that enable the management of digital identities and their access to resources. IAM is essential for ensuring that only the right people have access to the right resources at the right time. 

Components of Identity and Access Management

IAM systems typically include the following components: 

• Authentication: The process of verifying the identity of a user. This can be done using a variety of methods, such as passwords, two-factor authentication, and biometric authentication.
• Authorization: The process of determining what resources a user has access to based on their identity and role. 
• User management: The process of creating, modifying, and deleting user accounts. This includes managing user attributes, such as name, email address, and job title. 
• Central user repository: A database that stores all user information, including their identity, authentication credentials, and authorization information. 

Benefits of Identity and Access Management

IAM provides a number of benefits to organizations, some of which includes: 

• Improved security: IAM helps to protect organizations from unauthorized access to their resources. By verifying the identity of users and controlling their access privileges, IAM can help to prevent data breaches, malware infections, and other security incidents. 
• Increased compliance: IAM can help organizations to comply with industry regulations and standards, such as GDPR and HIPAA. By implementing strong IAM controls, organizations can demonstrate that they are taking steps to protect their data and systems. 
• Reduced IT costs: IAM can help organizations to reduce their IT costs by automating user management tasks and streamlining access control. IAM can also help to reduce the number of support tickets that IT departments receive. 

Identity and Access Management Implementation 

The implementation of IAM can be complex and challenging, but it is an essential investment for any organization that wants to protect its data and systems. There are a number of IAM solutions available, both on-premises and cloud-based. Organizations should choose an IAM solution that meets their specific needs and requirements. 

Identity and Access Management Best Practices 

There are a number of best practices that organizations can follow when implementing and managing IAM, including: 

• Use strong authentication methods: Organizations should use strong authentication methods, such as two-factor authentication, to verify the identity of users. 
• Implement role-based access control: Organizations should implement role-based access control, which assigns permissions to users based on their roles. This helps to ensure that users only have access to the resources they need to do their jobs. 
• Regularly review user permissions: Organizations should regularly review user permissions to ensure that they are still appropriate. This is especially important after changes to job roles or organizational structure. 
• Use a central user repository: Organizations should use a central user repository to store all user information. This helps to simplify user management and improve security. 
• Educate users about IAM: Organizations should educate their users about IAM and best practices for security. This includes teaching users how to create strong passwords, how to spot phishing emails, and how to report suspicious activity. 

Identity and Access Management (IAM) is an essential framework for ensuring the security and compliance of organizations. By implementing and managing IAM effectively, your organization can protect its data and systems from unauthorized access and reduce its risk of cyberattacks. 

The post Demystifying Identity and Access Management appeared first on MODIVA.

One additional capability that comes included with Defender for Servers is Microsoft Defender for Endpoint. See more details about the integrated solution here.

Background

One advantage of this native integration is the centralization of alerts, in other words, when an alert is triggered by MDE, it will be surfaced in the Microsoft Defender for Cloud / Security Alerts dashboard

If you select one alert, you can get more details about it and take action on the alert to start your investigation or remediation of it. You can also click on the link to be brought directly to the Microsoft 365 portal to investigate the alerts there.

Which dashboard should you look at?

As you can see, these alerts can be investigated from both dashboards of Microsoft Defender for Servers in the Azure Portal and from Microsoft Defender for Endpoint in Microsoft 365 Defender.

So which dashboard should you use?

The answer is your choice and lies entirely with how your Information Security Team is consuming the alerts and managing the devices.

However, we can give you some guidance on best practises that we have seen to work with many customers.

A SIEM is the recommended started point for investigation for all Defender for Cloud alerts (not just those coming from MDE).

Note: You might see duplicate alerts in Microsoft Sentinel, coming from Microsoft defender for Cloud and Defender for Endpoint. This is a known behaviour if Defender for Endpoint sensor was onboarded via Defender for Cloud.

In the absence of a SIEM and if you’re a general SOC team doing the investigation (not focused on just endpoints), we recommend that you start your investigation of alerts on Microsoft Defender for Cloud, and you can easily go to Microsoft 365 Defender to further your hunt via Defender for Endpoint.

On the other hand, if you’re a team who focuses entirely on endpoints who are doing the investigation of the alerts, then you can use just the Microsoft 365 Portal.

In summary, you can use whichever dashboard or method you choose to investigate the alerts, but you can decide based on the criteria listed above.

Culled from Microsoft Blogs

The post Defender for Endpoint and Defender for Cloud- which dashboard should you use? appeared first on MODIVA.

Cybersecurity architects continuously collaborate with leaders and practitioners in IT security, privacy, and other roles across an organization to plan and implement a cybersecurity strategy that meets the business needs of an organization.

If this is your skill set, we have a new certification for you. The certification validates your expertise in this area and offers you the opportunity to prove your skills. To earn this certification, pass SC-100: Microsoft Cybersecurity Architect exam (currently in beta) as well as any one of the following: SC-200, SC-300, AZ-500, OR MS-500.

Is this the right certification for you?
This certification could be a great fit if you have significant experience in a wide range of security engineering areas including identity and access, platform protection, security operations, securing data and securing applications. You should also have experience with hybrid and cloud implementations.

Ready to prove your skills?
Take advantage of the discounted beta exam offer. The first 300 people who take Exam SC-100 (beta) on or before May 5, 2022, can get 80 percent off market price!

To receive the discount, when you register for the exam and are prompted for payment, use code SC100ARCH. This is not a private access code. The seats are offered on a first-come, first-served basis. As noted, you must take the exam on or before May 5, 2022.

Culled from Microsoft Blogs

The post New certification for Security Architects appeared first on MODIVA.