Microsoft: Multifactor Adoption Remains Low

New data shows a slow roll to strong authentication for most enterprise Windows systems.

More than three-quarters (78%) of organizations with Microsoft Active Directory (AD) currently do not employ multifactor authentication (MFA) for their user accounts, new telemetry from Microsofts Azure Active Directory service shows.
The data, published today in Microsofts new quarterly
Cyber Signals report
, also includes an eye-popping stat about the volume of identity attack attempts: In 2021, Azure Active Directory detected and blocked over 25.6 billion attempts to brute-force user accounts.
We see, every second, about 580 to 600 password attacks [attempted], said Microsoft CISO Bret Arsenault in an interview with Dark Reading. So that means there are about 18 billion every year.
While multifactor authentication, Arsenault noted, is a key defense to protect organizations from cyberattacks – especially ransomware – adoption has been slow, adding that 99.9% of breaches would be prevented if you just implemented MFA.
When we look at these systems and we see that not everyone has implemented MFA, I think thats one of those things thats most amazing to me is how long it takes those entities to go get [MFA deployed], he said.
A
new study by Okta
found that attackers target Microsoft 365 accounts that are not MFA-protected 10 times more or higher than accounts that dont use so-called legacy authentication, or the traditional single-factor password method.
The conclusion we should draw is that attackers are predominantly targeting Office 365 via legacy protocols, says Brett Winterford, senior director for cybersecurity strategy at Okta. Why go to the trouble of trying to bypass MFA when there are accounts that only require a username and password?
AD servers themselves have become a juicy target for cybercriminals. Take ransomware attacks, which feed off stolen credentials that are then used to fan out to encrypt multiple machines in a victim organization.
Domain controllers [such as AD] are the primary target of ransomware actors. From this one server, the attacker can discover and access every device on the network and very quickly bring an organization to a grinding halt, Winterford says. Were routinely reading reports of ransomware groups moving from a single compromised account to domain admin in a mere matter of hours.
Properly configuring AD accounts can be difficult for some organizations, Winterford says, and misconfigurations can leave them open to attack.
The move to remote and hybrid work – coupled with a wave in job resignations and moves amid the pandemic – has complicated the management and security of user accounts as well.
The access rights tied to individual identities often change when a user moves to a different group in the company or gets a promotion, for example, notes Omdia analyst Don Tait.
Thus they require these moves, adds, and changes, which can be managed centrally. But in highly distributed orgs, there may well be delegation to the individual business unit, which means different levels of admin access [that] may cross geographies and time zones, Tait says. The explosion of digital and hybrid work styles [and] the amount of machine and human identities has increased dramatically. The rapid shift to hybrid work has left many organizations susceptible to cybercrime [that] leveraged identities to gain access.
AD servers also can store personally identifiable information, which could leave an organization in legal peril if the servers were breached, not to mention the financial fallout from ransomware or extortion attacks, he adds.
Three Fs
Arsenault said his team at Microsoft takes a risk-based approach to MFA adoption – one that he summed up in three basic steps: find, fix, and follow up.
First, find potential identity security risks, he said. Most entities have people who are overpermissioned. See where theres legitimate need to high access – like to an Active Directory server, Arsenault said.
This step entails checking who needs read access to what, for example, and locating areas where theres oversharing of data or access, he explains.
Then the work of MFA is really targeting on risk areas first, meaning for the fix phase, Arsenault said. Its not a static process, so he recommends regular follow-up of identity security to ensure no other user access issues emerge.
Microsoft has multiple layers of defense for its AD environment, including MFA and device-hardening, he said. He recommended organizations that have not leveraged them yet at least roll out two-factor/multifactor authentication for end users.
If you cant start with anything administrative [user identity-wise] ... find who needs to have these elevated privileges, for instance, he explained.
Protecting AD server privileges starts with limiting the number of admins tasked with creating user accounts for a domain, according to Omdias Tait.
Ensure that all humans and machines are rooted in strong, nonreputable digital identities, he says. The proven approach in the market today is with digital certificates.
Meanwhile, Microsofts new report also shows that the vendors Defender for Endpoint blocked over 9.6 billion malware infection attempts in 2021, while its Defender for Office 365 saw some 35.7 billion phishing and other malicious email traffic last year. Both data points encompass enterprise and consumer accounts.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft: Multifactor Adoption Remains Low