{"id":51113,"date":"2023-03-21T16:00:00","date_gmt":"2023-03-21T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=126477"},"modified":"2023-03-21T16:00:00","modified_gmt":"2023-03-21T16:00:00","slug":"gain-real-time-identity-protection-with-microsoft-and-recorded-future","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/gain-real-time-identity-protection-with-microsoft-and-recorded-future\/","title":{"rendered":"Gain real-time identity protection with Microsoft and Recorded Future"},"content":{"rendered":"
<\/div>\n

This blog post is part of the Microsoft Intelligent Security Association <\/em>guest blog series<\/em><\/a>. <\/em>Learn more about MISA<\/em><\/a>.<\/em> <\/p>\n

You\u2019ve implemented multifactor authentication for access to your enterprise network. But what if multifactor authentication isn\u2019t as foolproof as you\u2019re hoping?<\/p>\n

Are you comfortable betting your organization\u2019s security on it?<\/p>\n

Multifactor authentication isn\u2019t a silver bullet<\/h2>\n

The premise behind multifactor authentication<\/a> is a good one\u2014anybody who wants to access your network needs two or more things:<\/p>\n

    \n
  1. Something they know (such as a password or personal identification number).<\/li>\n
  2. Something they have in their possession (cryptographic identification device, token).<\/li>\n
  3. Something they are (biometric, fingerprint).<\/li>\n<\/ol>\n

    Users enter two of those (or three of them, to access especially sensitive resources), your server authenticates them, and they\u2019re on your network. It\u2019s more robust security than a simple username and password, and it makes bad actors work a lot harder to access your network.<\/p>\n

    That\u2019s why multifactor authentication is such a commonly used approach in security for solving the problem of leaked or compromised credentials. But it\u2019s not foolproof, and here\u2019s why Recorded Future thinks you can do better.<\/p>\n

    SMS is vulnerable<\/h2>\n

    Many multifactor authentication products, especially the ones suitable for consumer use, rely on SMS and send a code to the user\u2019s phone in a text message. Unfortunately, SMS can be hacked or spoofed<\/a>, with the result that the bad actor receives the code and is able to pass the authentication test.<\/p>\n

    Also, not all applications support multifactor authentication\u2014that\u2019s especially true of older systems\u2014which leaves the door open to bad actors. There are passwordless authentication methods, but credentials are used to authenticate the system on the back end, so password security and the user\u2019s identity can still be avenues for compromise.<\/p>\n

    Multifactor authentication isn\u2019t enough<\/h2>\n

    Threat actors can brute force their way into accounts, defeat multifactor authentication, and breach organizations. There are many ways, unfortunately, that threat actors can accomplish this.<\/p>\n

    One way is by hijacking session cookies<\/a>. Another way involves exploiting default multifactor authentication protocols. For instance, the United States Cybersecurity and Infrastructure Security Agency<\/a> recently released a report warning that Russian state-sponsored threat actors were able to gain network access by taking advantage of an account set to default multifactor authentication protocols. That allowed them to enroll a new device for multifactor authentication access in their victim\u2019s network, and then take advantage of a critical Windows vulnerability to run any code they wanted on the hacked network\u2014with system privileges. One small mistake with multifactor authentication enabled threat actors to gain not only access but also significant control over the network.<\/p>\n

    Beyond multifactor authentication: Identity Intelligence from Recorded Future<\/h2>\n

    Of course, threat actors are trying to breach thousands of networks every day. Suppose you had up-to-date intelligence that told you about their attempts all over the globe. That would give you a lot more information about them than just their IP address. Wouldn\u2019t that help you decide whether their visit to your site was legitimate or not?<\/p>\n

    That\u2019s the identity management<\/a> model Recorded Future uses with Identity Intelligence<\/a>. It arms security teams with real-time information about identity compromises worldwide so they can respond confidently, without any manual research. Identity Intelligence automates the collection, analysis, and production of intelligence from open-source, dark-web, and technology entities, including unique sourcing of malware log<\/a> information. It combines that intelligence with world-class research to deliver an unmatched source of truth for identity management and authentication at a massive scale.<\/p>\n

    Identity Intelligence covers the most prominent use cases that enterprises face in a landscape of employees, partners, supply chains, and customers in an era of account takeovers and identity fraud:<\/p>\n