Authentication using many factors for your business's online services

Prior to the widespread use of public cloud services, businesses housed their digital corporate services on their own property, which they could only access through their local network. These services were enhanced with usernames and passwords to verify requests for access to company information. Physical connectivity to the network from within the office building served as a “pseudo second factor” for these services. In other words, the user verifies their identity by proving they

• own the right secret password.
• exist on the actual private network.

However, organizations are increasingly storing their corporate sensitive data in online services (that is, services that are exposed to the internet). These online services are frequently hosted in the cloud or on-premises and accessible via a remote connection, like zero trust network access (ZTNA) or a virtual private network (VPN).

The loss of this pseudosecond factor, or the inability to access the network solely locally, means that relying solely on a password to authenticate a user to an online service is insufficient to safeguard sensitive information.

Because passwords can be stolen in a variety of ways, administrators are advised to use multi-factor authentication (MFA) in the NCSC’s password guidelines. However, in response to increased adoption of MFA, attackers have developed new methods to access accounts protected by weaker methods of MFA. For example:

• the one-time password (OTP) interception attack, also known as the “machine-in-the-middle attack,” in which a user is tricked into entering their OTP code on a phishing website that is disguised to give the attacker the credentials they need to log in as that user.
• Push notification fatigue attack, also known as “prompt bombing attack,” occurs when a user is repeatedly prompted to approve a request until they unintentionally approve the attacker’s sign-in.