Cyber attacks have been around for years but seem to be especially prevalent today with so many working remotely. We continue to stress the importance of safe email and password practices, along with tools, such as Multi Factor Authentication (MFA.)
Microsoft recently noted (see zdnet.com) in referring to recent hacking attacks, that hackers have easily gone from broken passwords to full control of networks in quick time. One such hacking group, called Holium, has been very successful in cracking easy passwords using cloud-based attack vectors. There are multiple ways the hackers can infiltrate a network.
- through spear-phishing emails
- attempts to use lists of well-known passwords to break into accounts, known as “password spraying.”
- Using another tool called “Ruler,” which is a penetration testing tool.
Typically, password spraying is used first, targeting organizations that do not use MFA. Ruler, then gives the hackers control over the PC.
What is Multi Factor Authentication (MFA)?
MFA is a security mechanism that requires an individual to provide two or more credentials in order to authenticate their identity. These can be passwords, hardware tokens, numerical codes, etc. There are various MFA programs out there. We typically recommend Google Authenticator. For Google, a number on your phone (associated with the application you are logging into) changes every 30 seconds or so. When asked, you enter this unique number each time you log in. For the phone test method (that you probably use with your bank, etc.) a number is sent to you when you log in via text, that is different each time, and you have to enter this to be authenticated. We have had success with this method.
We strongly recommend considering all of these methods of prevention to avoid disaster to your business. Please also read our blog post on best practices when using email to avoid phishing scams. Stay safe and stay healthy!
