Organisations are currently facing a significant challenge known as cloud account takeover. Consider the extensive amount of work your company undertakes, necessitating the use of usernames and passwords. As a result, employees find themselves having to log in to numerous systems and cloud applications.
Hackers employ diverse techniques to acquire these login credentials with the ultimate objective of accessing valuable business data under the guise of legitimate users. Additionally, they can execute intricate attacks and send phishing emails from within the organisation. The severity of account breaches has reached alarming levels, with a staggering 307% increase in account takeover incidents between 2019 and 2021.
Doesn’t Multi-Factor Authentication Stop Credential Breaches?
Numerous organisations and individuals employ multi-factor authentication (MFA) as a reliable method to thwart attackers who have obtained usernames and passwords. MFA has proven highly effective in safeguarding cloud accounts over the course of several years. However, the success of MFA has motivated hackers to devise alternative methods. Among these malicious tactics is push-bombing, which aims to circumvent MFA safeguards.
How Does Push-Bombing Work?
When a user activates multi-factor authentication (MFA) for their account, they typically receive a code or authorization prompt as part of the login process. The user enters their login credentials, and the system subsequently sends an authorisation request in the form of a “push” message. This push notification can be received through various means such as SMS/text, a device popup, or an app notification. Receiving such a notification is a regular occurrence during the MFA login procedure and is familiar to the user.
However, in the case of push-bombing, hackers exploit the user’s credentials, which they may have obtained through phishing or from a data breach password dump. They take advantage of the push notification mechanism by repeatedly attempting to log in. As a result, the legitimate user receives multiple consecutive push notifications. This influx of unexpected codes may raise suspicion among users who question their authenticity. Nevertheless, the continuous bombardment of push notifications can wear down the user, making it easier for them to mistakenly approve access in order to cease the notifications.
Push-bombing represents a social engineering attack strategy that aims to confuse, fatigue, and deceive the user into unwittingly approving the MFA request, thereby granting the hacker access to the account.
Ways to Combat Push-Bombing at Your Organization
Educate Employees
Understanding the significance of knowledge, it becomes evident that experiencing a push-bombing attack can cause disruption and confusion for users. However, with proper education beforehand, employees can enhance their preparedness to protect themselves against such attacks. It is also essential to provide your staff with a means to report these incidents, enabling your IT security team to notify other users and take necessary measures to safeguard everyone’s login credentials.
Reduce Business App “Sprawl”
Typically, employees engage with an average of 36 distinct cloud-based services on a daily basis. Managing such a multitude of logins poses an increased risk of password theft. It is crucial to assess the number of applications utilised within your company and explore strategies to minimize app “sprawl” by consolidating them. Platforms such as Microsoft 365 and Google Workspace provide a range of tools accessible through a single login. By streamlining your cloud environment, you can enhance both security and productivity..
Adopt Phishing-Resistant MFA Solutions
Complete prevention of push-bombing attacks can be achieved by transitioning to an alternative form of multi-factor authentication (MFA). Phishing-resistant MFA employs a device passkey or physical security key for the authentication process, eliminating the need for push notifications to approve access. While this type of authentication solution may require more complex setup procedures, it offers significantly enhanced security compared to text or app-based MFA methods.
Enforce Strong Password Policies
In order for hackers to initiate multiple push notifications, they must possess the login credentials of the user. By enforcing robust password policies, the likelihood of password breaches can be significantly diminished. Adhering to standard practices for strong password policies entails:
- Incorporating both uppercase and lowercase letters.
- Employing a combination of letters, numbers, and symbols.
- Avoiding the inclusion of personal information when creating a password.
- Ensuring secure storage of passwords.
- Refraining from reusing passwords across multiple accounts.
Put in Place an Advanced Identity Management Solution
Additionally, businesses can use identity management solutions to install contextual login policies. These enable a higher level of security by adding access enforcement flexibility. The system could automatically block login attempts outside a desired geographic area. It could also block logins during certain times or when other contextual factors aren’t met.
Do You Need Help Improving Your Identity & Access Security?
Multi-factor authentication alone isn’t enough. Companies need several layers of protection to reduce their risk of a cloud breach.
Are you looking for some help to reinforce your access security? Give us a call today to schedule a chat.