{"id":4061,"date":"2021-01-05T07:01:21","date_gmt":"2021-01-05T12:01:21","guid":{"rendered":"https:\/\/www.stratospherenetworks.com\/blog\/?p=4061"},"modified":"2020-12-02T17:07:42","modified_gmt":"2020-12-02T22:07:42","slug":"why-using-mfa-sso-could-actually-increase-your-cybersecurity-risk","status":"publish","type":"post","link":"https:\/\/www.stratospherenetworks.com\/blog\/why-using-mfa-sso-could-actually-increase-your-cybersecurity-risk\/","title":{"rendered":"Why Using MFA\/SSO Could Actually Increase Your Cybersecurity Risk"},"content":{"rendered":"
\n
\n

\"TwoIf you’re a hacker trying to break into someone’s account, the most obvious method involves guessing or stealing the password. That’s why stringent security requirements for passwords are so important and why cybercriminals focus so heavily on\u00a0phishing campaigns<\/a>\u00a0meant to trick people into disclosing their login info. More than 80 percent of data breaches caused by hacking involve brute force or the utilization of stolen or lost credentials, according to Verizon’s\u00a02020 Data Breach Investigations Report<\/a>.<\/p>\n

Password security<\/a>\u00a0has become more imperative than ever because of the pandemic-driven prevalence of work-from-home arrangements, as CISOs must secure remote access accounts. In addition to ensuring employees know best practices for setting strong passwords and leveraging\u00a0spoof phishing software<\/a>\u00a0to train staff members to spot malicious messages, many businesses leverage\u00a0multi-factor authentication (MFA)<\/a>\u00a0and\u00a0single sign-on (SSO)<\/a>\u00a0solutions to avoid data breaches. However, these measures often aren’t as effective as they could be due to a lack of enforcement and auditing.<\/p>\n

Putting MFA and SSO Into Practice: The Trouble With Inconsistent Implementation<\/h2>\n

MFA and SSO both help companies lower their odds of experiencing a data breach when utilized properly. MFA \u2013 which is also called two-factor authentication in some instances \u2013\u00a0adds an extra layer of protection by requiring at least one additional piece of information for verification in addition to your username and password. It can stop hackers wielding stolen credentials in their tracks: In 2019,\u00a0Google released research<\/a>\u00a0showing that on-device prompts sent out to verify sign-in attempts stopped 100 percent of automated bots, 90 percent of targeted attacks, and 99 percent of bulk phishing attempts.<\/p>\n

Meanwhile, SSO allows end users to access multiple accounts and apps with one set of credentials. Just about half (51 percent) of U.S. IT professionals and IT security practitioners report that they have difficulty managing their passwords, according to\u00a0the\u00a02019 State of Password Authentication Security Behaviors Report<\/a>\u00a0from the Ponemon Institute and Yubico. SSO addresses that issue while also lowering the odds that end users will get hacked because it decreases the number of credentials they use, as\u00a0Citrix explains<\/a>.<\/p>\n

However, simply stating requirements for MFA and SSO usage throughout your organization won’t necessarily be enough to decrease your data breach risk level. Companies that don’t take steps to make sure their team members actually put these solutions into practice can end up dealing with an inconsistent mess, with some end users enabling MFA and SSO for some apps and others remaining at risk. As a result, it’s vital to invest in auditing and enforcing the utilization of these security measures.<\/p>\n

Auditing and Enforcing MFA and SSO Usage Across Your Organization<\/h2>\n

If you’d like to improve your organization’s governance of SSO and MFA usage, you’ll need a clear understanding of your current situation. Create a comparison matrix that includes all your line-of-business apps. Then list these options for the apps’ status:<\/p>\n