To enhance the security of multi-factor authentication (MFA), Microsoft will mandate that users verify login attempts by inputting a numerical code into the Microsoft Authenticator application.
MFA is a crucial aspect of identity and access management; however, it is not infallible, as attackers increasingly utilize social engineering techniques to bypass MFA safeguards. To bolster MFA security, Microsoft is implementing “number matching” for all users of the Microsoft Authenticator app.
Previously, the process flow for Microsoft Authenticator simply presented
- a prompt within the app when a user attempted to log into an application.
- The user would tap the prompt on their secondary device to authorize the transaction.
- Number matching introduces an additional step by necessitating users to possess the secondary device and view the login screen on the primary device.
- Instead of simply tapping the prompt, users will now be required to enter a numeric code displayed on the application’s login screen.
Source: Microsoft
For instance, when logging into Office 365, individuals will see a message on the original login screen containing a numerical code. To approve the transaction, they must input this code into the Authenticator app on their secondary device. There is no option to opt out of entering the code.
An additional layer of security
To strengthen protection against MFA fatigue attacks, individuals can implement an extra layer of defense by restricting the quantity of MFA verification requests per user through Microsoft, DUO, Okta, or alternative platforms.
Source: Microsoft
Additionally, they can lock user accounts or issue notifications to the security team or domain administrator when these thresholds are surpassed.
Limitations of number codes
While number matching is a potent defense against MFA fatigue attacks, it is not infallible. Cybercriminals can still employ social engineering tactics to deceive users into approving fraudulent requests. Hence, educating users about the dangers of MFA fatigue attacks and how to identify counterfeit requests is vital.
Furthermore, organizations should implement alternative security measures such as monitoring user conduct, utilizing threat intelligence tools, and deploying security solutions capable of preemptively detecting and preventing attacks.
Ending thought
Multi-factor authentication is a necessary security measure for safeguarding against cyberattacks. However, the susceptibility to MFA fatigue attacks poses a risk to the efficacy of this security measure, potentially compromising sensitive data.
With the implementation of number matching, Microsoft has taken a significant stride in combating MFA fatigue attacks. Organizations must emulate such initiatives to fortify their systems and protect their data from evolving cyber threats.
Marrium Akhtar
May 12, 2023
1 year ago
