We finished the multi-factor authentication programme, reported ninety-eight percent enrolment to the board, and closed the risk. Four months later an attacker signed in to a finance mailbox with nothing but a username and a password.
They had not defeated our second factor. They had gone around it. Our mail platform still allowed an older protocol that predates modern authentication and cannot present a challenge, so the platform does the only thing it can and accepts the password on its own. We had left that protocol enabled for three reasons, all of them true at the time: a scanning appliance that mailed reports, a handful of handsets belonging to people who would not accept a new client, and one integration in finance that nobody wanted to touch during year end. Because per-user scoping had never been configured, the exception was applied to the whole tenant.
What followed was ordinary. A password spray against a publicly reachable endpoint, one account with a password reused from somewhere breached years earlier, a quiet mailbox rule forwarding anything containing the word invoice, and an attempt to redirect a supplier payment. We did not detect it. The supplier rang to query a change of bank details.
The lesson I took is narrower and more useful than "MFA is not enough". Multi-factor authentication is not a property of an account. It is a property of every authentication path that reaches the resource, and enrolment percentage measures the wrong object entirely. We had counted people. Nobody had counted doors.
So we now inventory authentication paths rather than users, and the question at review is not how many are enrolled but how many ways remain to reach this data with a password alone. Every legacy protocol exception is scoped to named identities and source addresses, carries an owner and an expiry date, and raises an alert every time it is used, which turns out to be a very quiet alert and therefore a very good one.
The sign-in logs will answer this for most organisations in an afternoon. It is worth the afternoon. Ours had been telling us for four months and nobody had asked.
– Serguey Shinder
Top comments (0)