Corporations and big businesses are the most desired objects of cyber attacks, credential theft and various types of phishing scams. And for a good reason. Huge money and a great amount of data are involved and there are usually hundreds of weak spots where the attack can happen.
With the growth of cybersecurity technology, the hackers shift their interest in attacking the areas that are much easier to compromise. People.
Social engineering - tricking people into doing things or sharing information - has become one of the most important buzzwords in cybersecurity.
A well socially engineered attack usually involves some kind of bait or a threat usually with a call to action that requires a victim to act fast. In fact, receiving such a call or an email should always raise a red flag that something may be wrong. This kind of attacks usually result in a victim entering some classified resources or passing some sensitive information to an attacker.
Attacks on C-level executives, so-called whaling phishing attacks, are much more difficult to prepare and often takes months to plan and execute.
Attacks on lower level employees, that seemingly should be less dangerous can also bring great damage to the business, so that’s why they are still way more popular and effective.
In the majority of corporations and big organizations, low-level employees have access and work with sensitive data every day. A receptionist, an accountant, an HR specialist, regardless what place they hold in a company structure, they often work with sensitive data, usually without even knowing the value of the information they work with.
The Pareto principle works great here. 20% of the information that a user has access to can potentially cause 80% of problems caused to leaks and thefts.
In the vast majority of companies, the access is granted to either all or nothing. There are no easily applicable mechanisms that can help company security monitor and supervise access to extra sensitive information.
Therefore there are many ways in which things can go wrong.
Let’s assume now that Jenny, a girl working in the HR department is totally bored with her work. She doesn’t pay attention to what she’s doing, and all her actions are done halfway. If she’s not paying attention to what she’s doing then it’s more than sure that she doesn’t pay much attention to company’s data security policies.
Some actions can be dangerous, some can be illegal and some are simply worth tracking to be able to make some conclusions and introduce fixes. Regardless of the scenario normally the organizations don’t have tools that can be easily introduced to fix these risks.
The difficult thing about cybersecurity was always balancing on the line of data protection and user comfort.
Two biggest challenges that security teams face every day are:
1. How to increase the level of security without making a user's life too hard?
Although data security, in theory, should always be a priority of each business unit, in reality, people always look for ways to make life easier not harder, so if they can skip a security procedure that causes them too much burden - they will.
2. How to increase the level of security operating on a very limited budget?
Let’s face it. Cybersecurity always comes last, and the space in the budget for this area usually comes after something happens. A successful breach, phishing attack, data fraud. That’s the moment when CEOs decide to invest in data protection.
So what’s the remedy?
We call it “microauthorizations”.
Microauthorizations were designed to make the user journey almost unaffected while substantially increasing the level of data security.
Microauthorizations help easily add additional authorization step anywhere in the application, without touching its code.
With microauthorizations it is possible to:
It really can be that simple.
To learn more about microauthorizations you can check this short showcase that we did during the technology event in Berlin.
You can also watch a complete 2FA method deployment performed on Amazon.com and executed in just minutes.
The majority of 2FA methods rely on a one-time password (OTP) that you need to verify your credentials with. While all 2FA methods without doubt significantly increase the security level comparing to password-only protection it is still possible to compromise a user account with a more advanced attack (using tools for a real-time phishing, such as Modlishka or Evilginx2).
In contrast, Universal Second Factor (U2F) Security Keys employ a physical device that a user need to have at all times during the workday. This setup is regarded as the strongest authentication method and has not yet been compromised.
This technology had been battle-tested by Google and since deployed none of Google’s 89,000 of employees have been compromised by a succesful phishing attack.
The biggest reason why U2F security keys have not become a golden security standard just yet was a cost factor. Deploying this technology was tied to a long and expensive coding process. Most of times the maintenance of the application and the necessity of sticking to one vendor service was a good enough reason to give up on the idea of deploying U2F protection within a company.
Today, it is possible to deploy U2F security keys authentication in a matter of minutes and at a fraction of previous cost. And, big companies don’t need to share any of their information with third-parties any longer. Instead, U2F keys technology can now be added seamlessly on top of the current infrastructure.
Without software development, without contractors, and without a vendor lock-in. The authentication process protection lays on the additional security layer that enables 2FA authentication on any applicacion without touching the code.