CyberSec.Cafe

Brewing Cybersecurity Insights

Author: CyberSec_Cafe (Page 3 of 4)

The Pros and Cons of vCISO and CISO-as-a-Service

May 17, 2023 / / 0 Comments

Navigating the Challenges of Cybersecurity Leadership

The Pros and Cons of vCISO and CISO-as-a-Service
Image by Bing Images Creator

Introduction

Virtual CISO – vCISO and CISO-as-a-Service are emerging as popular options for organizations looking to strengthen their cybersecurity posture without hiring a full-time CISO. Sorry for the over-simplification but it would basically be a part-time Security Expert acting as a CISO. While these services offer certain benefits, they also come with potential drawbacks. In this article, we’ll explore the advantages and challenges of vCISO and CISO-as-a-Service and discuss how to find the right balance.

The Benefits of vCISO and CISO-as-a-Service

  1. Access to expertise: vCISO and CISO-as-a-Service can provide organizations with the cybersecurity expertise they might not have in-house. This can be especially valuable for smaller companies or those just starting their security journey. Please note that security professionals are a hot commodity, and organizations should ensure they are using resources with the right skills. For example, someone who configured firewalls might be considered a (Network) Security Expert, but will they be the right expert to define a long term Cybersecurity strategy?
  2. Temporary solution: vCISO and CISO-as-a-Service can serve as a temporary measure to fill the gap in cybersecurity leadership, especially when organizations face difficulties in hiring a full-time CISO or during transitional periods.
  3. Flexibility: vCISO and CISO-as-a-Service offer flexibility for organizations experiencing transition or growth. These services can be scaled up or down according to the organization’s needs, providing a tailored solution to their cybersecurity challenges.

The Limitations of vCISO and CISO-as-a-Service

  1. Accountability: While vCISOs and CISO-as-a-Service providers hold a “C” in their title, they may not have the same level of accountability as a full-time, in-house CISO. Organizations looking to meet ESG (Environmental, Social, and Governance) requirements may need a more accountable figure in the role. In other words, did you ever see a vCFO or a CFO-as-a-Service?
  2. Integration, Authority, and Long-term Strategy: vCISOs and CISO-as-a-Service providers may not have the same level of authority within an organization, potentially limiting their ability to effectively integrate with various departments and functions. Moreover, due to the limited length of their contract and insufficient knowledge of the company (technology, processes, people, and culture), they may struggle to plan and implement a comprehensive, long-term security strategy, leading to a focus on quick wins instead.
  3. Conflict of Interest: If a vCISO or CISO-as-a-Service provider is affiliated with a company that sells or provides cybersecurity services, there may be a conflict of interest. This can result in a lack of neutrality, which could affect their advice and recommendations and even questionable decision-making. Especially because they are not accountable (see point 1, jointly with this point it is a potential recipe for disaster). However affiliation it is not necessary a bad thing as it would allow to involve specific vertical competencies of other Subject Matter Experts when necessary.
  4. Incident Management: A CISO is expected to be involved in the management of cyber incidents. A vCISO, being part-time, might struggle to handle multiple major incidents simultaneously for different clients, potentially prioritizing the one that pays better or has a longer contract remaining.

Finding the Right Balance

While vCISO and CISO-as-a-Service can be valuable solutions for organizations in transition, small businesses part of bigger groups with real CISOs (in this case I also saw a case of an internal CISO-as-a-Service, and this appears to be a great idea) and scaleup companies, it’s essential to consider potential limitations and conflicts of interest. Ideally, organizations should work towards cultivating internal talent to eventually assume the CISO role.
In cases where a trusted internal candidate is not yet ready or a CISO has recently resigned, vCISO and CISO-as-a-Service can be effective interim solutions to put paper over the cracks. However, it’s essential to ensure that the chosen provider is competent, neutral, dedicated to the organization’s best interests, and ideally has knowledge of the industry. Moreover, organizations should make sure that someone internally is identified (e.g., COO or CIO) to be accountable.

Conclusion

I may be biased since I was an advisor for a long period of my career, but these services are not that different from the “old approach,” which is still an alternative: using strategic consultancies and in-house IT and/or system integrators to complete projects. What matters is recognizing the importance of security, regardless of whether the person helping them is called a CISO-on-demand or a security advisor.

vCISO and CISO-as-a-Service can provide much-needed cybersecurity expertise, especially for small businesses and scaleup companies.

When considering the use of vCISO and CISO-as-a-Service, it is essential for organizations to carefully assess the benefits and limitations of these options. By taking into account factors such as access to expertise, competencies (and not just title and certifications), flexibility, accountability, integration, authority, long-term strategy, conflict of interest and involvement in case of incidents, businesses can make informed decisions about whether these services are the right fit for their cybersecurity strategy.

Ultimately, fostering internal talent and working towards a full-time CISO role may be the best long-term solution. Small businesses and organizations in transition can benefit from the expertise and flexibility offered by vCISO and CISO-as-a-Service but must have a holistic approach in selecting a provider who can effectively address their unique cybersecurity challenges and should continuously reevaluate their cybersecurity needs and ensure that their chosen option remains effective .

The Need for a Passwordless Future

May 8, 2023 / / 0 Comments

AI, Password Cracking, and the Shift to Modern MFA

The Need for a Passwordless Future: AI, Password Cracking, and the Shift to Modern MFA
Photo by Miguel Á. Padriñán from Pexels

Introduction

As artificial intelligence (AI) continues to evolve, it’s becoming increasingly easier for it to crack passwords. This alarming statistic highlights the need for a passwordless future, where modern Multi-Factor Authentication (MFA) methods like FIDO 2 replace traditional, less secure methods.

The Power of AI in Password Cracking:

According to HomeSecurityHeroes, even a seemingly strong password can fall prey to AI-powered attacks in a matter of seconds. In fact, 51% of common passwords can be cracked in less than a minute.

Hive systems confirms this and add that even a brute-force attack using a consumer-budget desktop computer with a top-tier graphics card, or leveraging cloud compute resources, can yield worrisome results.

With the rapid evolution in AI, it’s becoming more important than ever to start evaluating a passwordless future to ensure the security of our digital assets.

Why We Should Move to Passwordless?

A passwordless future offers numerous benefits, as outlined in this Help Net Security article. Moving to passwordless solutions can:

  1. Improve security by eliminating the risk of weak or reused passwords.
  2. Enhance user experience, as there’s no need to remember complex passwords.
  3. Reduce the cost and time associated with password management.
  4. Facilitate a more straightforward and secure remote work environment.

Oh nice, but why can’t I just use a password manager and with long complex and unique passwords?

While password managers offer protection against password cracking, they are not a foolproof solution. We will cover the advantages and disadvantages of password managers in a future article, but it’s important to remember that they are not a substitute for moving towards a passwordless future.

Ok, So why can’t I just use MFA?

That’s a great idea, and I already wrote about the flaws of traditional MFA methods and merits of modern secure ones here and here so I won’t repeat myself but I’ll continue to suggest adopting modern MFA, eventually as an in between step towards a passwordless future.

Conclusion

As the ease of password cracking increases, the need for a passwordless future becomes more pressing. By moving away from traditional password-based authentication, organizations can significantly enhance their cybersecurity posture and protect their valuable digital assets.

Ok, so I just have to go for passwordless and that will solve all the problems?

Well, no (sorry, I tricked you – that wasn’t the conclusion of the article).

It’s essential to be cautious and understand the limits of technologies when implementing passwordless and MFA solutions. For instance, simply using a prompt-based MFA can leave users vulnerable to MFA prompt flooding attacks or other social engineering attacks.

Imagine removing the password and having users susceptible to MFA flooding attacks, where the attacker doesn’t even need to steal the credential first.

Microsoft is aware of this issue, which is why they offer passwordless authentication and are enabling number matching MFA for all Microsoft Authenticator users (here I describe the difference between this method and the prompt-based approach).

The Need for a Passwordless Future – Real conclusion/recommendation

First, adopt a modern MFA solution, considering its potential limits. Then, start moving away from traditional password-based authentication. This way, organizations can significantly enhance their cybersecurity posture and protect their valuable digital assets.

My Top Popular LinkedIn Posts for April 2023 🚀

May 8, 2023 / / 0 Comments

April has been an eventful month in the world of cybersecurity, especially with the ChatGPT block saga taking center stage.

Let’s dive into the top popular LinkedIn posts that sparked discussions and caught some attention:

  1. Espionage Campaign Linked to Russian Intelligence: Prioritizing human security in the face of cyber threats 🕵️
  2. Darktrace NDR apparently was Hacked: A shocking revelation 😲 and its follow-up Darktrace NDR Hacked Update: A surprising turn of events 🚨
  3. Importance of Security Exercises: my interview discussing preparation of organizations for cyber incidents through regular exercises 🛡️
  4. ICO Fines TikTok 127£ Milion for Misusing Children’s Data💷

The Chat GPT saga (to put the saga in context start with my analysis on Unraveling the ChatGPT Block in Italy, shedding light on the geopolitical implications of AI and Privacy regulation 🌐 also on this site ):

  1. ChatGPT Confidentiality Issues: The risks of AI leaking sensitive information 🤯
  2. Italian DPA Blocks ChatGPT: Regulating AI to protect user privacy 🚫
  3. OpenAI Collaborates with Italian DPA: A partnership to ensure AI compliance 👥
  4. German DPA Jumps in: Safeguarding user data across borders 🇩🇪
  5. EDPB Taskforce on ChatGPT: Addressing data protection concerns on a European level 🌐
  6. ChatGPT Unblock and Resuming Services: A compliant AI returns to the market 🟢 and ChatGPT’s Italian Comeback 🇮🇹

With the exception of the aforementioned article linked to the ChatGPT Saga I’m not considering contents of this blog, even if you find those on LinkedIn these are contents of this blog.

Be sure to check back next month for another roundup of the most popular LinkedIn posts! 

How to Choose a MFA in 2023

April 28, 2023 / / 0 Comments

In today’s rapidly changing digital environment, Multi-Factor Authentication (MFA) has become increasingly important in protecting your sensitive data and accounts from unauthorized access. Following the feedback received on the previous article, “Why Multi-Factor Authentication as you know it is not enough in 2023“, I’ve compiled a list of MFA options, ranked from the least to the most secure.

How to Choose a MFA in 2023 – MFA techniques

  1. Worst: Password-only authentication
    Relying solely on a password for account security is the least secure option. Passwords are vulnerable to brute force attacks, social engineering, and various other hacking techniques.
  2. Bad: Call & SMS
    While better than just using a password, Call & SMS-based MFA is susceptible to channel jacking attacks and requires a phone carrier. SIM swapping and other telecom exploits can bypass this method.
  3. Good: TOTP, Oath token, Push notification, and Authenticator apps.
    These options are only susceptible to real-time phishing attacks. Push notifications and authenticator apps are slightly better but require connectivity and a smart device. They provide a higher level of security, especially when used in combination with other MFA methods.
    Biometrics
    Enhances security but may not always be convenient or accessible, and raises privacy concerns
  4. Better: Authenticator app with number matching prompt, FIDO passkeys These methods are less susceptible to real-time phishing attacks but require a more sophisticated attack to be compromised. Number matching prompts and FIDO passkeys add an additional layer of security, making it harder for cybercriminals to gain unauthorized access.
  5. Best: Hardware-based MFA like FIDO2 and Windows Hello.
    The most secure MFA options are hardware-based solutions, such as FIDO2 and Windows Hello. These methods store cryptographic keys on a physical device, providing the highest level of security against unauthorized access and real-time phishing attacks.

Additional Complementary Authentication Options

While the following options are not strictly MFA, they can complement and enhance your chosen MFA solution to create a more robust and secure authentication experience:

  • Single Sign-On (SSO) and Identity Federation
    streamlines authentication but requires robust security measures and for the latter also trust between participating organizations
  • Risk-based or Adaptive Authentication
    dynamic method that can increase security while reducing the authentication burden on users in low-risk scenarios
  • Continuous and Behavioral Authentication
    monitors user behavior and context throughout a session, detecting anomalies and signs of compromise in real-time

MFA can be hacked

While MFA offers an essential layer of security, it is crucial to remember that no security measure is foolproof, as detailed by KnowBe4. MFA can be hacked through various methods, such as phishing and social engineering attacks. Even hardware based MFA is subject to physical attacks.

To protect against these threats, organizations should consider implementing additional security measures like employee security culture (awareness, training, phishing simulations) and Identity detection and response systems. By combining MFA with other cybersecurity best practices, it is possible to strengthen the defenses and reduce the risk of unauthorized access to the systems.

Conclusion

Choosing the right MFA method is crucial for ensuring your digital assets’ safety.

By understanding the strengths and weaknesses of each option, you can make an informed decision that best suits your security needs, taking into account your specific requirements, budget, and user experience considerations. To maximize security, it’s essential to continually revise and update your authentication strategy as new threats and technologies emerge. By prioritizing the most secure methods and staying vigilant against ever-evolving cyber threats, you can effectively safeguard your digital assets and stay ahead of cybercriminals.

Stay tuned as the next article will be on AI Password cracking, role and issues of password managers and shift to password-less.

Integrating XDR and Zero Trust

April 17, 2023 / / 0 Comments

The Power of Effective Cybersecurity

In my article on Zero Trust I promised an in-depth exploration on the integration of Zero Trust and XDR, here it is.

As cyber threats become increasingly sophisticated and complex, traditional security approaches no longer suffice in protecting organizations from data breaches and other security incidents. This is where integrating Zero Trust and XDR technologies comes into play, providing a more effective way to reduce risk and safeguard sensitive data.

Zero Trust is a security approach that assumes all users, devices, and applications are untrusted and continuously verifies access, while XDR (Extended Detection and Response) is an advanced threat detection and response platform that enables security teams to detect and respond to attacks across multiple attack vectors and endpoints.

Integrating these two technologies can help organizations achieve a higher level of security by leveraging the strengths of each. Here are some key benefits of integrating XDR and Zero Trust:

  1. Improved Detection and Response Capabilities

By integrating XDR and Zero Trust, security teams can enhance their detection and response capabilities. XDR can detect potential threats across multiple attack vectors, while Zero Trust can automatically block potentially malicious network destinations, breached identities, and breached devices. This combination enables security teams to respond quickly and effectively to potential threats.

  1. Better Risk Management

The integration of XDR and Zero Trust provides better risk management by combining threat detection and response with access control. With Zero Trust, access is continuously verified and controlled, while XDR can identify potential threats and provide insights to help mitigate risk.

  1. More Efficient Threat Management

XDR and Zero Trust integration can also improve threat management efficiency by automating the response to potential threats. For example, if an EDR system detects a suspicious event, XDR can use a playbook that incorporates Zero Trust to automatically block the event, with subsequent verification and unlocking in case it is a false positive. This approach is more efficient than traditional inspection methods and can help security teams respond to potential threats quickly and effectively.

  1. Simplified Security Operations

Integrating XDR and Zero Trust can simplify security operations by consolidating security tools and technologies. With XDR and Zero Trust working together, security teams can reduce the number of tools and technologies they need to manage, making security operations more efficient and effective.

In conclusion, the integration of XDR and Zero Trust is a powerful combination that can provide organizations with a more effective way to reduce risk and protect sensitive data. By leveraging the strengths of each technology, organizations can enhance their detection and response capabilities, improve risk management, simplify security operations, and achieve compliance with regulatory and industry standards.

Battling Burnout in Cybersecurity

April 6, 2023 / / 0 Comments
Battling Burnout in Cybersecurity
Photo by fauxels from Pexels

5 Key Strategies for Enduring Team Resilience

Introduction

The cybersecurity field presents unique challenges and stressors, resulting in change fatigue that threatens the sustainability of security teams.

Why are cybersecurity teams burning out? Talent shortages, understaffing, and fading motivation are hitting hard, and employee burnout is becoming one of the biggest threats to cybersecurity teams. To address this growing problem, it’s crucial to implement strategies that promote sustainability and mitigate fatigue among cybersecurity professionals.

In recent speech on talent (I already talked about this in a LinkedIn Post), I shared my experience of a resignation of a key resource that ultimately resulted in me becoming a better leader. By acknowledging the failure and learning from it, I was able to create a more supportive and understanding environment for my team.

In a recent Gartner article, “Four Tactics to Mitigate Change Fatigue,” CIOs are provided with valuable strategies to combat change fatigue within their organizations.

While primarily targeting CIOs, these tactics can be adapted to address the sustainability crisis in cybersecurity teams, or any team. These are all strategies that I pursue (badly or well can only be said by the people who work with me). In this article we’ll explore those revised four strategies and my additional ones, to ensure a lasting journey of fatigue mitigation.

Strategies for a Sustainable Journey of Fatigue Mitigation in Cybersecurity Teams:

  1. Treat change fatigue as a business issue: Cybersecurity is particularly stressful due to the constant security debt and the fear of being hit by a major attack. Balancing short-term objectives with long-term goals is crucial to prevent employee burnout, anxiety, that ultimately ends in resignation. It’s important to incorporate change fatigue as a factor when planning initiatives and prioritize projects to reduce the impact of fatigue on the team, e.g. by avoiding excessive workload, or the week-end warriors phenomenon.
  2. Distribute change leadership: Decisions in cybersecurity often require trade-offs between business, as-is operations, and security. Engaging business leaders and experts in decision-making at all levels can lead to more successful outcomes and reduce the burden of decision-making, which is a key cause of stress. Collaboration among different leaders is essential for making informed decisions. I’d add that also clear responsibilities are a must as unclear expectations are another a big source of stress. A key point here is that Cybersecurity leaders should hold the other leaders accountable in making the organization more secure (if this accountability fails, the organization will be significantly less secure).
  3. Co-create execution and involve stakeholders: In the long run, employees who feel a sense of purpose and are involved in the change management process will become the “leaders of tomorrow.” Creating cross-pollination between teams is paramount, with attacks targeted on people (e.g., phishing, CEO Fraud), on the supply chain, all departments must collaborate to secure the enterprise. This principle is also true inside of the Cybersecurity function, resources working on detection and response and those focused on protection measures must all know the vision and the strategy and know what the others are doing, this is crucial for a more cohesive and empowered team.
  4. Focus on the journey, not just the end goals: Instead of solely concentrating on the end goal, emphasize the process and progress made throughout the journey. Security is a continuous journey, not a goal that can be reached. By celebrating progress and creating a positive environment, the team will feel accomplished and motivated during the entire journey.

Allow me to add some additional personal strategies: make sure that employees are supported, they feel valued, have a work-life balance, and have the opportunity for personal growth and development. It’s essential to provide continuous feedback, both positive and negative, and to clearly explain what is good and what needs improvement. This empowers employees with the right to fail, as long as they learn from their mistakes and grow. Addressing issues in real-time ensures the team remains successful, rather than waiting until the end of the year to provide a feedback and having low performances in the meantime.

Bottom line, cybersecurity staff should feel committed and believe that the cybersecurity leadership is composed of individuals with a little more experience who empower them.

Conclusion

Adapting the strategies above can help address the sustainability crisis in cybersecurity teams by mitigating change fatigue and successfully battling burnout in cybersecurity.

By treating change fatigue as a business issue, distributing change leadership, co-creating execution, and focusing on the journey rather than just the end goals, cybersecurity teams can remain resilient and effective in an ever-evolving landscape. Embracing change and personal growth as a leader is essential to building a strong, empowered, and sustainable team.

Is too much Security a Big Cyber Risk?

April 3, 2023 / / 0 Comments

Finding the Right Balance

Photo by Pixabay from Pexels

In the ever-evolving world of cybersecurity, finding the right balance between protection and flexibility is crucial for organizations. While it might seem counterintuitive, having too much security can be just as risky as having too little. Overly restrictive measures can slow down or even block business operations, pushing employees to bypass protocols and increasing risk.

In a previous article, we discussed how Zero Trust can help organizations achieve both security and flexibility. In this article, we’ll explore the risks of too much security and provide guidance on finding the perfect balance to safeguard your organization without stifling innovation. But why is finding this balance so important? Let’s delve deeper into the consequences of not having the righ security balance and how it can negatively impact your organization.

  1. Understanding the risks of too little security:
  • High agility but increased cyber risk
  • The impact of security incidents can be severe
  • Lack of preparedness and response plans
  1. The dangers of too much security:
  • Business operations are slowed or blocked
  • Employees may bypass security protocols, leading to shadow IT
  • Costs and resources may be wasted on unnecessary security measures
  1. Finding the right balance:
  • Conduct a thorough risk assessment to identify threats and vulnerabilities
  • Prioritize security measures based on the organization’s unique needs and risk profile
  • Implement a layered approach to security, focusing on prevention, detection, and response
  • Continuously monitor and evaluate the effectiveness of security measures
  1. Fostering a security-aware culture:
  • Encourage a culture of security awareness and accountability throughout the organization
  • Provide regular training and education for employees on security best practices
  • Establish clear policies and guidelines for secure behavior
  1. Embracing flexibility and adaptability:
  • Stay informed of the latest cybersecurity trends and threats
  • Regularly reassess and adjust security measures as needed
  • Adopt a proactive approach to security, anticipating potential risks before they materialize

Conclusion: Striking the right balance between too little and too much security is a delicate task, but it’s essential for organizations looking to protect themselves from cyber threats while maintaining business agility. By understanding the risks associated with both extremes and implementing a well-rounded cybersecurity strategy, businesses can reduce their risk exposure and thrive in today’s complex digital landscape.

Unraveling the Chat GPT Block in Italy

April 3, 2023 / / 2 Comments

Geopolitics, AI Regulation, Inconsistencies, and Constitutionality

Photo by Andrew Neel

On Friday, March 31st, the Italian Data Protection Authority (Garante della Privacy) announced the temporary restriction of Italian users’ data processing by OpenAI, resulting in the blocking of Chat GPT access for Italian users later that evening. Many people in Italy woke up on April 1st to find Chat GPT not working and, given the date, mistakenly assumed it was an elaborate April Fool’s Day prank. The situation is more complex than that. Here are some key insights: 

  1. Geopolitical implications: The EU is working on comprehensive AI regulation, including the Artificial Intelligence Act, which aims to create a legal framework for AI in Europe. However, Europe and the US have been slow to regulate AI. There is a deeper reason for that, as I mentioned in this LinkedIn post, EU and US regulations will not deter China and Russia, who could use AI advancements as a competitive advantage. The ongoing US-China tech rivalry and concerns over AI’s potential dual-use capabilities for military and civilian purposes may influence global AI regulation. So why US and EU should slow down to allow the competitors to gain advantage? This Politico article provides an interesting perspective on the issue.   
  2. Post-Brexit European dynamics: With Germany and France as the main European powers, Italy aims to assert itself as the third power, influencing the balance when Germany and France disagree. 
  3. Italy’s move to restrict OpenAI could be an attempt to establish itself as a key player in European and global political chessboard, aiming to be seen as a precursor to broader EU regulations, potentially influencing the direction of the upcoming policies and to project soft power in the technology domain, showcasing its ability to take decisive action and influence the global AI landscape. 
  4. Timing is always a factor, Elon Musk earlier last week asked to stop AI development to regulate it. Elon Musk, one of the original founders of OpenAI, left the organization in 2018. Microsoft has since invested $10 billion in OpenAI, and while not the direct owner, its influence is significant. This may be a factor in Musk’s call to stop AI research, as I discussed in this LinkedIn post. 
  5. Another relevant point is that no other Data Protection Authority took action, which led to complaints considering that the GDPR has a broader scope than just Italy. The event highlights the importance of international collaboration in Data Protection and AI regulation to avoid fragmentation and inconsistencies. Establishing global norms and standards for AI technologies can foster responsible development and deployment across countries 
  6. The block is akin to block the wind with the hands, users can still access Chat GPT via VPNs, (such as NordVPN, which currently offers a 40% discount on their plans), as I mentioned in this LinkedIn post, or with alternative access means: Bing allows access to Chat GPT, and Microsoft manages GDPR requirements properly. Additionally, some creative minds have developed PizzaGPT, using the original APIs of Chat GPT. 
  7. One of the Garante’s concerns was the protection of minors. However, it is unclear why the same level of scrutiny is not applied to platforms like TikTok and WhatsApp. 
  8. Another point to consider is the potential violation of the ‘right of information,’ as stated in Article 21 of the Italian Constitution. By blocking Chat GPT, the Garante could be infringing upon this fundamental right, as it restricts citizens’ access to a tool that can provide valuable information and insights. It raises the question of whether the Garante’s decision may be overstepping its mandate and interfering with citizens’ constitutional rights.

In conclusion, the situation surrounding Chat GPT in Italy is multifaceted, involving geopolitical dynamics, European power struggles, and questions around the consistency of data protection measures. It’s crucial to consider all these factors when examining this event and its implications for Data Protection and AI regulation and international relations. 

Why MFA as you know it is not enough in 2023

April 2, 2023 / / 0 Comments
Why MFA as you know it is not enough in 2023

Due to the overwhelming response and engagement on my recent LinkedIn article about MFA, I’ve decided to reprise it here for completeness.

As online threats continue to evolve, it’s more important than ever to protect your accounts with multi-factor authentication (MFA). But not all methods are the same.

Traditional MFA methods like SMS codes are no longer secure enough to prevent sophisticated attacks. Even advanced MFA methods like push notifications have their own drawbacks. So, what’s the best way to defend yourself against online threats? According to the National Cyber Security Centre (NCSC), using Fido2 keys has been shown to be a secure and convenient MFA option. Nice to know that they share my view 😊

Why MFA is necessary: In today’s digital world, passwords alone are not enough to secure online accounts. With data breaches and hacking attempts on the rise, it’s essential to add an extra layer of protection to your accounts. MFA does just that by requiring users to provide multiple forms of authentication to access their accounts. By combining something you know (like a password) with something you have (like a physical key or token) or something you are (like a footprint), MFA makes it much harder for attackers to gain access to your accounts.

Traditional MFA methods such as SMS codes are no longer secure. While SMS-based MFA has been a popular choice in the past, it’s no longer considered a secure option. The U.S. National Institute of Standards and Technology (NIST) removed SMS-based MFA from its list of recommended authentication methods in 2021 due to its vulnerabilities. According to cybersecurity expert Brian Krebs, “SMS-based 2FA [two-factor authentication] is not only less secure than other forms of 2FA, it’s not really 2FA at all.”

Even advanced MFA methods such as push notifications have problems. Push-based MFA has become more popular in recent years, but it still has its own limitations. According to the European Union Agency for Cybersecurity (ENISA), push-based MFA can be vulnerable to man-in-the-middle attacks (an attacker intercepts communications between two parties), MFA bombing (attackers repeatedly push second-factor authentication requests to the target victim for them to approve it) and may not provide sufficient protection against social engineering tactics. ENISA recommends that users consider using hardware tokens or biometric authentication instead.

So back to Fido 2, why is it more secure? Fido2 cryptographic login credentials are unique across every website, never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, password theft and replay attacks. According to the World Economic Forum, FIDO-based authentication solutions are more providing greater protection against phishing and man-in-the-middle attacks (nice to know that they also share my view 😊). Google use it and has reported that it has not had a single confirmed account takeover since it started requiring its employees to use Fido2 keys in 2017.

In conclusion, the importance of using strong MFA to protect your online accounts cannot be overstated. Traditional MFA methods like SMS codes are no longer secure, and even advanced methods like push notifications have their own limitations. Use the strongest method you can. By using MFA method like Fido2 keys, you can significantly reduce the risk of your accounts being compromised. Don’t wait until it’s too late – take action now to improve your online security with MFA.

Disclaimer: I do not have any financial or professional interest in promoting FIDO 2 technology or any specific security solution. My views on the importance of MFA and the vulnerabilities of traditional authentication methods are based on my professional experience in cybersecurity and my analysis of industry research and best practices.

My Top 10 Popular Linkedin Blog Posts for March 2023 

March 31, 2023 / / 0 Comments

LinkedIn is an excellent platform for professionals to share their thoughts, experiences, and insights. And I share a great quantity of information in there. 

Each month, we compile a list of the top ten LinkedIn posts, highlighting the most engaging content you may not find here.

So, without further ado, let’s dive into this month’s top posts! 

  1. My opinion on the Ferrari data breach: I discuss how Ferrari’s transparent communication strategy helped maintain brand equity after a recent data breach.
  2. How failure helped me to be a leader and a better man: I reflect on an resignation of a key employee in 2018 that taught me the importance of employee appreciation and recognition.
  3. Is ad-blocking technology ethically acceptable?: I explore the debate around ad-blocking technology and the responsibility of ad providers in ensuring ads are safe.
  4. Interview on Exercise and Preparedness:  I discuss the importance of regular security exercises for organizational resilience.
  5. Why Multi-Factor Authentication as you know it is not enough in 2023: My first LinkedIn article that led to the creation of CyberSec.Cafè. 
  6.  Comment on people telling anyone their passwords: I advocate for investing in Cyberculture and FIDO 2 Keys. (Ok, you should have understood by now that this is one of my fetishes)
  7. “how could we possibly …?” (repost of David Owen): I share insights on why known cyber vulnerabilities can go unaddressed for years (TL/DR: nobody was looking).
  8. My Speech at Security4Busiless: alongside of brilliant personalities. I recount my speech on business continuity and cybersecurity and how they are linked, which ,after several perils, I can say that it was the first flame that brought thoughts, to the creation of this blog.
  9. European Parliament bans TikTok from staff phones I discuss the significance of this decision for data privacy and compliance.
  10. “True Story“: yes just 2 words – A simple, relatable comment on a repost that sparked further discussion. The original post content helped however…

I’m not considering contents such as the creation of this blog (it’s wild, it’s my top linkedin post in terms of views – I was afraid nobody would have visited this blog) or the article on Zero Trust as, even if you find those on LinkedIn these are contents of this blog.

Commentary: This month’s top ten LinkedIn posts showcase the diverse range of topics and insights within the cybersecurity and technology industries. From the technological topics (Zero Trust and Multi Factor Authentication), to my approach on winning the talent war (learned in the University of Life) to thought-provoking discussions on emerging risks and challenges, these posts demonstrate the importance of staying informed and engaging with thought leaders.  

Be sure to check back next month for another roundup of the most popular LinkedIn posts! 

« Older posts Newer posts »

© 2024 CyberSec.Cafe