Demystifying Cybersecurity: How to Thwart Phishing Attacks with Enhanced Identity Management

One of the pillars, called user identity, prefers a continuous authentication process, monitoring user activity and access requests, to protect and secure all interactions between said user and a corporate infrastructure, rather than a one-off authentication, as security posture and associated risk can change over time. It is composed of two layers: authentication and authorization. In the first one, the user will need to be properly and undoubtedly identified, ensuring said person is who they claim to be, using a combination of well-proven security technologies, including Single Sign On (SSO), Multi Factor Authentication (MFA), Certificates (e.g., smartcard) or Biometrics (e.g., fingerprint, face recognition), or a combination of these.

Let’s review together the different forms of authentication available with MFA and see which one(s) is(are) recommended to use to make that process resistant to phishing attacks.

What is MFA?

Multi-Factor Authentication (MFA) is an authentication method, part of the Identity and Access Management (IdAM) framework, that requires a user to present two or more pieces of evidence (or factors) to authenticate. These factors include but are not limited to something a user knows, like a credential – such as a password or PIN, something a user physically possess, like a mobile device, hardware token, or Credit “Card Verification Value” (CVV), or something a user is, like his fingerprints or palm prints, his iris, or his voice.

This makes it a great security mechanism that organizations must implement as part of any ZT architecture. However, it is not the magic key to perfect security and still has its few weaknesses that can be exploited. Security is larger than just one solution, so other security mechanisms should be implemented in combination with MFA to strengthen it even more.

Limitations and Vulnerabilities

While implementing MFA is a crucial measure in mitigating the risk posed by cyber threat actors who exploit compromised credentials to infiltrate networks and carry out malicious actions, it is important to highlight that not all types of MFA offer the same level of security.

Some of them are actually vulnerable to cybersecurity attack like typical phishing attacks, a deceptive tactic where cybercriminals trick individuals into revealing sensitive information, such as passwords or financial data, by posing as trustworthy entities in fraudulent emails or websites, or less known SIM swap attacks, that involves a malicious actor tricking a mobile carrier into transferring a victim's phone number to a SIM card under their control, often used for unauthorized access.

Another known attack is Push fatigue attack, colloquially known as “push bombing,” a social engineering technique that sends an overwhelming amount of MFA notifications to drive the user to accidentally approve the login attempt or approving just to make the MFA notification prompts to go away.

Finally, more advanced but still very real, malicious cyber actors take advantage of vulnerabilities within the Signaling System 7 (SS7) protocol, a set of telecommunications signaling protocols used for setting up and managing telephone calls and text messaging, to acquire MFA codes sent through text messages (SMS) or voice calls to a mobile phone."

When any of these attacks are successful, they potentially enable a malicious actor to acquire MFA authentication credentials or circumvent MFA to reach MFA-protected systems.

MFA Comparison

MFA authentication forms have been evolving over the years, to become more and more secure and resistant to ever growing cybersecurity threats.

OTP via SMS or voice, also known as Two-Factor Authentication (2FA), involves users providing their password as the first factor. Upon login, a one-time verification code is sent via SMS or voice call to their registered phone number. They enter this code to gain access, adding an extra layer of security to the login process. This method ensures that users possess both a password and physical access to their mobile device.

App-based authentication in MFA relies on a dedicated mobile users must on their mobile device, to complete the authentication process. We can mainly distinguish three different versions/evolutions of it.

App-based authentication with Push notification is the most basic authentication form. It begins with users entering their password as the first factor; the second factor involves a push notification sent to the user's registered mobile app, that they need to manually approve to complete the login, enhancing security by confirming their presence and consent for access.

App-based authentication using One-Time Passcode (OTP) enhances the earlier. It involves users providing their password as the first factor. The second factor is a unique, time-sensitive code, generated by either a mobile app, such as Microsoft Authenticator or Google Authenticator, or a physical device, like a hardware token. Users will need to provide that OTP during login, enhancing security by requiring something they know (password) and something they have (the mobile app).

App-based authentication with Number matching in one of the latest evolutions. It involves users entering a password as the first factor; the second factor comes from a dedicated mobile app or physical device, which generates a unique code. But then additionally, the system verifies that the user's account or device matches the expected number or information, enhancing security.

Source: https://bit.ly/blog-231031

Fast Identity Online (FIDO) and Web Authentication (WebAuthn) are standards for passwordless and strong authentication for online applications and services, allowing users to log in without traditional passwords by using biometrics, hardware tokens, or other secure methods. This approach enhances security, reduces reliance on passwords, and simplifies the authentication process for users.

Public Key Infrastructure-based (PKI-based) MFA combines PKI technology with MFA methods for secure user authentication. It uses digital certificates and private keys for identity verification, typically requiring something the user knows (a PIN or password) and something the user has (a digital certificate stored on a smart card or mobile device). PKI-based MFA is commonly used in government, enterprise, and high-security environments to ensure robust authentication and data protection.

Let’s compare the different authentication methods either there are resistant to the most common phishing attacks: