Cloud account takeover has become a major problem for organizations. Just think about all the different systems and cloud apps that require a username and password. It can be overwhelming for employees to manage, and new threats like push-bombing are always surfacing.
Unfortunately, hackers have found various ways to steal these login credentials. Their goal is to gain access to valuable business data, launch sophisticated attacks, and even send insider phishing emails.
But how serious is the issue of account breaches? Between 2019 and 2021, account takeover (ATO) rose by a staggering 307%. It’s a clear indication of the growing threat.
Doesn’t Multi-Factor Authentication Stop Credential Breaches?
Many organizations and individuals rely on multi-factor authentication (MFA) to protect their cloud accounts. MFA has been effective for years in preventing attackers who have obtained usernames and passwords.
However, hackers are constantly finding ways to bypass MFA. One such method is push-bombing.
How Does Push-Bombing Work?
When a user enables MFA on their account, they usually receive a code or authorization prompt. The user enters their login credentials, and the system sends an authorization request to complete the login.
Typically, the MFA code or approval request comes in the form of a push notification. Users can receive it through SMS/text, a device popup, or an app notification.
While receiving these notifications is a normal part of the MFA process, hackers exploit it through push-bombing. They repeatedly attempt to log in, bombarding the legitimate user with multiple push notifications.
Receiving unexpected codes can confuse users, and they may accidentally approve access when overwhelmed with notifications. This form of attack aims to deceive, wear down, and trick users into granting the hacker access.
Ways to Combat Push-Bombing at Your Organization
Educate Employees
Knowledge is power. Educate your employees about push-bombing and how it works. Provide training on what to do if they receive MFA notifications they didn’t request. Encourage them to report such attacks so that your IT security team can take necessary steps to secure everyone’s credentials.
Reduce Business App “Sprawl”
On average, employees use 36 different cloud-based services per day. Managing multiple logins increases the risk of a stolen password. Evaluate your company’s applications and look for ways to consolidate and streamline them. Platforms like Microsoft 365 and Google Workspace offer multiple tools under one login, enhancing both security and productivity.
Adopt Phishing-Resistant MFA Solutions
You can prevent push-bombing attacks by switching to a different form of MFA. Phishing-resistant MFA relies on a device passkey or physical security key for authentication. Unlike push notifications, this method provides stronger security, although it requires more setup.
Enforce Strong Password Policies
Strong password policies decrease the chances of hackers bombarding users with push notifications. Ensure that employees use passwords with a mix of uppercase and lowercase letters, numbers, and symbols. Discourage using personal information and encourage secure password storage. Additionally, emphasize the importance of not reusing passwords across multiple accounts.
Put in Place an Advanced Identity Management Solution
Advanced identity management solutions simplify login processes and help prevent push-bombing attacks. These solutions often combine all logins into a single sign-on system, reducing the number of MFA prompts for users. Moreover, contextual login policies can be established, allowing stricter access enforcement based on factors like location or time.
Do You Need Help Improving Your Identity & Access Security?
While multi-factor authentication is crucial, it’s essential to implement multiple layers of protection to reduce the risk of cloud breaches. If you’re a Fresno or Visalia area business looking to strengthen your access security, don’t hesitate to contact us.
This Article, adapted, has been Republished with Permission from The Technology Press.
