CISA Lists Allowing SFA for Remote Access Credentials Is Dangerous
The US Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has updated the agency’s list of bad cyber security practices. The site now includes single-factor authentication (SFA) as a bad practice. The post is directed at critical infrastructure organizations but the advice applies to all IT networks.
SFA means that only one login credential – such as only a password or a PIN number – is needed to access an IT network or the hardware attached to it.
Requiring a single login credential rather than two (two-factor authentication or 2FA) or even multi-factor authentication (MFA) is a risky practice. Attackers can guess at usernames and passwords over and over again until they get lucky and are able to compromise a corporate network. Even low-tech hackers can sick another computer on a network to do the password login attempts for them at high speeds. This is a type of attack known as a brute force attack.
Hackers commonly buy stolen email addresses, usernames, and passwords heisted in previous data breaches.
This week T-Mobile, the largest 5G mobile carrier in the United States, was successfully compromised in a brute force attack. The personal account information of over 50 million T-Mobile customers was stolen.
“Although these Bad Practices should be avoided by all organizations, they are especially dangerous in organizations that support Critical Infrastructure or National Critical Functions,” says CISA.
It’s common (and a bad idea) for people to reuse the same password for both personal and work logins. This leaves your financial information and your employer’s sensitive corporate information at risk.
When an organization uses 2FA or MFA, systems require a combination of two or more pieces of information to access a computer network or hardware. For example, logging into your work email may require a password. The second step in 2FA might require you to respond to a text message sent to a phone that is associated with your email account
Other CISA bad practices include:
- Continued use of unsupported or end-of-life software
- Use of known or default passwords and login credentials
- The use of single-factor authentication for remote or administrative access to systems or software
All companies, individuals, and organizations should review the CISA Bad Practices webpage. It is updated as needed.
CISA operates as a standalone organization under DHS. The agency is responsible for the cyber security in the United States.
