How Resilient is your MFA? - Shammas H

Good morning. Thank you for attending today. I hope you've enjoyed today's talk. But before I crack on, let me ask you all a question. Have you ever thought about what you would do if your mobile phone stopped working? Many of us may have opted to perhaps utilize something such as one drive to back up our documents. Or maybe you have opted to have a NAS drive. But how many of us have actually thought about our MFA? And to make today's session a bit more interactive, I've made a slide poll. So feel free to join in by just scanning the QR code or if you prefer joining in at the website.com and entering the following code. So I'll give you folk a

couple of minutes to just uh quickly uh answer and we'll be utilizing the slido throughout today's session to hopefully make it a bit more interactive

and this is actually better than what I got at work. So all my colleagues are 100% saying no. So this is great. Uh but hopefully there'll be some good takeaways for you all by the end of today's session. But before we uh crack on, let me give you a quick introduction as to who I am. So I'm Shamas, also go by the pseudonyame cyber shams online. I work as a security consultant for Cisco as part of the security advisory wing of the business. Outside of work, I'm a keen horse rider. One thing to know is if you do go horse riding, please do wear a helmet, a body protector, and suitable footwear. Do not do what I'm doing here. To be honest

with you, my friend said to me, "Do you fancy hopping on?" And I said, "Sure." So, um, outside of that, I also run a podcast called Early Cyber and I also volunteer for the charity Kidney Research UK. I'm a very keen advocate of chronic kidney awareness and as well as that I'm a member of the UK cyber security council as a youth advisory panel member. So you probably sat there, Shamas, of all the topics out there, why on earth have you talk uh chosen to talk about MFA and let me um tell you a story and it starts with me traveling down to London to meet a close friend of mine who recently had a baby boy.

And as you do, you get on the trains. So I hopped on the train, traveled down, and got off at my last stop. and I've taken the route many times before, but to give me that extra sense of security, I always put in his address on my mobile phone. So, I put it in, started following it, and I began to realize, hold on a sec, where on earth is this taking me? But I thought Google's never been wrong before. Well, let's carry on following it. It wasn't before long. I was in the middle of god knows where and I was thinking, "Oh, shoot." Uh, long story short, ended up getting an Uber. As I'm sat in the back of the Uber, my phone

starts doing all sorts of weird and wonderful things and I had a panic attack. What am I going to do about my tickets? But then I thought to myself, uh, as any sane person, does I carry multiple phones on me? So, worse comes to worse, I can access my tickets on my backup phone. But then came the realization, my banking apps. What am I going to do about them? But then I thought it's relatively easy. I can pop down to my local branch and I can say to them, do you mind sorting me out? And uh then came the realization of my authentication apps. I've got over 30 accounts relying on this one phone. Should they stop working tomorrow, I'm

screwed. So I started looking into it and today I'm going to share with you what I found. So firstly, what does MFA actually look like today? Well, over the years we've seen a number of different iterations. Starting off with messagebased MFA. This is your SMS codes or perhaps codes being sent to your email. Then we have hardware keys. Again, we've seen multiple iterations over the years with the latest being 502. Thereafter, we have authenticator apps. Again, there's different flavors of this. Some being pushbased, simply doing a yes or no, whereas others require a bit more interaction. Perhaps you need to match a number on the screen and so forth. And last but not least, our pass

keys. And just to get a feel again of what's going on in the room, feel free to answer and share with us what you're actually utilizing. Please note I differentiated between passes that are synced and passes that are device bound. And I'll talk a little bit more about the differences in the next slide.

And what's quite interesting to see already is the fact that some of us are already using messagebased MFA despite both N and NCSC recommending against it. But it's good to see the variety out there and some of us already using Pasis. So, I'm going to introduce you to Shamas's magic quadrant. For those of you who are in the industry, you'll be familiar with Gartner's version. I've come up with my own for MFA. So, in the lower left uh corner, we can see MFA methods that fall into the category of having low resiliency and low security. [clears throat] In the top left, um items that fall into high resiliency but still low security. Thereafter moving on to the right hand side items

that fall into uh the bottom left uh bottom right sorry low resiliency high security and in the top right best of both worlds having high resiliency and high security. So why have I placed SMS where it is? Well firstly it's susceptible to quite a few different attacks as listed on screen. But in terms of resiliency, I've given it a slightly higher rating because at least in my opinion, it's relatively easy to contact your network provider and have them sent you a new SIM to your house. In contrast, moving on to the right hand side with authenticator apps, hardware keys, and pass keys that are device bound, they all introduce a single point of failure. Should you lose your

hardware keys or your device where your authenticator apps are stored or pass keys, you're locked out. So what is the solution to this? Utilizing pass keys that are synced. Now don't get me wrong, they do have their drawbacks which I will be talking about in the next couple of slides, but at least should you lose the device where your pass keys are, you can log into another device. uh and get access to them. So what does resiliency look like? Now we see different formats of this. Firstly, multiple MFA methods quite common with Google accounts. Uh whether that's having a backup email address associated with your account, sending a code to to your mobile phone or even having a pass key. Thereafter we

have multiple instances of the same method. So here you can perhaps have your authenticator apps on multiple devices or choose to have multiple hardware keys. And last but not least our backup recovery codes. But what should we be doing? Well, let me introduce you to 5.2. Now 5.2 2 is deemed or well deemed more secure or at least as secure as traditional MFA. But for those of you that aren't familiar with what 502 is, it stands for fast identity online 2. It's an open authentication standard and it utilizes public key cryptography and works with things like pass keys, face ID, fingerprint and so forth. Now, if you are an individual that prefers a bit more of a tactile

approach, then I would recommend getting the hardware key. Ensure that it is compliant with the 502 standard. Thereafter, purchase second with hardware key and keep it in a safe secure location. Now, if you're an individual that prefers a bit more of a digital approach, then I recommend opting for pass keys. One thing to be cautious of is please choose a reputable provider to store your pass keys. Do not find something that mess with CNN or something. Um thereafter ensure that the pass keys are synced. Quite often we find that uh pass keys by default they're not toggled to be synced. Now we don't live in an ideal world. So what do you do should a pass

keys not be available? Well firstly see if there's an option to generate backup recovery codes. Thereafter, try to store them in secure location, preferably a password manager. I'm guilty of this. You click the download button and leave them as a download folder. Uh don't do that. Thereafter, go through your accounts and begin to see where you're using message based MFA. Avoid it and begin to remove it. In a similar fashion, what you should start doing is again go through any old devices and see where your MFA is in place and remove those inactive accounts or accounts that you don't need on those devices. And last but not least, I know this is obvious, but many of us don't

like updating our devices cuz we're too busy. Uh remember to update your devices and applications on a regular basis. Now I've talked about why do talked about pass keys but why am I giving them such limelight? Well to help explain I've created the following table. So on the left hand side you can see different varying attacks and across the top I've listed different authentication methods ranging from password only to traditional MFA and thereafter to 502 credentials. And it's quite clear to see as we progress left to right the number of attacks that each method of authentication uh provides decreases. Now, as I was saying earlier, 502 is not absolutely bulletproof and there are situations where perhaps attacks may come through.

But one key thing to highlight is the fact that when it comes to fishing attacks, which make up the majority of attacks found by the Department of Science, Technology, and Innovation, they're never vulnerable to that. Also you may be thinking why on earth is something situational dependent and this comes to the security hardening of a device. So let's give an example. Let's say I leave my phone here. Somebody finds it tries to get in and access my pass keys. But firstly have I encrypted the device? Other factors include how good is my password? Is it 1 2 3 4 or is it something much longer? For reference, I keep 16digit password in there. So, don't try uh you lock it out. Now, some

of you may be sitting there saying this all well and good syncing pass keys, but some of you may be sitting there saying syncing pass keys is a bad idea. Now, it does present a novel risk and the NCSC also state this. But the reality is many of us rely on some form of synchronization in our day-to-day lives. Whether that's for our emails, whether that's for our password managers or even our authenticator apps, we utilize synchronization on a daily basis. The key control factor we need to remember is the strength of the sync account itself. Are we following good security practices there? But I want to be honest with you all. It's not all sunshines and rainbows.

A paski can be bypassed and so can a UB key. Palo Alto earlier this um year actually this month if I recall correctly disclosed three different attack paths for pass keys. They were all they were targeting a Google password manager and were able to extract the pass keys. But one key thing to call out is all three attack paths required the device to already be running some form of malware. But not only that, in terms of security, we need to focus in on usability. Again, earlier this month, Lance, who's a director at SANS, wrote the following post, and to summarize it at a very high level, who's clearly very um what's the right word to use? Well,

it was troubled by how difficult it is sometimes to implement Pasis. And keeping this in mind, I made the following version of the CIA triad, but I've broken it down into resiliency, usability, and security. And you may be thinking, why on earth have I done this? So, let me give you an example. When it comes to work, as an employee, you yourself, you primarily care about security and usability. Perhaps not so much resiliency due to the fact that if anything goes wrong, you can contact the help desk and lo and behold, they'll work some magic and everything will turn out fine. But when it comes to you at home, things will change. You're no longer protecting

some crown jewels of the business. So perhaps security will be less of the criteria for you and more so usability and resiliency. The key thing I'm trying to get across is as security professionals or practitioners, if our MFA looks this different, what is the reality for those outside of the security industry, the general public? As the uh top statistic on the screen shows, the reality is the vast majority or quite a large majority of the population will not understand MFA as a concept. Not only that, adults over the age of 60 are the most at risk to fishing. Now, given that we have an aging population in the UK, this number is going to continue to rise.

So what can we do about this? Fortunately, we have an MFA method out there that is fishing resistant 502 and it's our job to sort of sit down with our family members and help them understand. This is something that we all need to do as professionals in the industry. Begin to humanize and contextualize security for our family members. So perhaps you have a parent that's a bit more digital savvy. Introduce them to pass keys. On the other hand, you might have somebody that's a bit more tactile. Introduce them to hardware keys. The reality is I cannot tell you what will work best for your family members. That is for you to sort of sit down and

have those honest open conversations. So going back to me, well firstly I've decided to get a new mobile phone. I'm waiting for the new releases uh with the iPhone. Whether you hate me for choosing that, don't worry. I carry Android as well. Um but that isn't going to fix everything. I've started going through my accounts and some of them I've had since I was eight and started removing my SMS, MFA, and so forth. And I've started to close my old accounts as well, doing, you know, good practice auditing and everything I tell my customers to do. Um, and I've slightly opted for a bit of both worlds in terms of Pasis and hardware. Depends what accounts um, and

where I'm utilizing them. But I'm switching them slowly to 5.2. Now, given that we've got enough time, if you mind filling this up, it would be interesting to see what forms of MF are you planning on utilizing. I'm hoping the vast majority Well, nobody puts the top one. If you do, I'm I'm slightly worried for you. That's what we like to see. I'll give you a couple more seconds. [clears throat] Somebody changed their mind about message B. I mean, I think you can still choose to use that, but don't blame me if somebody gets into your car. like a friend that called me at half 11 at night. Somebody got into my account and said, "Whose fault is that?"

[clears throat] By the way, it's using email based MFA for every single account and his password was the equivalent of Cisco Bang 123. So, yeah, you'll be worried if I told you where he works as well. Um, so what do I want you all to do once you get home? Well, firstly review what MFA methods you're currently using. Thereafter, assess how resilient they are and begin to implement the concepts from this presentation. Thereafter, speak to those around you in your family and start to try to help them to do this as well. And to finish off, I'm going to leave you with a quote. If you truly want to change the world, start with yourself

and then see how you can help those around you. And with that, I conclude. Thank you very much. I open the floor to any questions. And also, [clears throat] if you want to send anything across, emails admins.com or you can find the site cybershams.com. And if you prefer, you can also post questions here as well. ANYBODY have any questions? >> I have one. Thank you for the great talk. It's really interesting. Um, myself and some of my family members were getting repeated MFA fatigue attacks recently. Microsoft authenticator. Um, how far does the PH key or the pass uh pass key syncing approach protect against fatigue attacks? >> Well, given that there's no essentially there's no push being sent.

So the way find two works is is with opas keys for example key cryptography. So you have a private key public key. So the public key is stored with the website or application that you're utilizing. Private keys with yourself. There's no way that somebody can keep sending you um pushes. Should have brought should have made another slide for this to explain this is I'm more of a diagram person rather than explaining it like this off the top. But essentially it removes that factor as well. >> Any other questions? >> No. Can we have another round of applause for >> um how can you extend this beyond just like personal MFA to um for example if

you have a company and then there are users signing on and you want to use MFA, how would you recommend what type they should use? Well, the the best practice as NCSC have dictated is opting for 2 now. So there's a big drive at the moment, especially the larger corporations. What we start recommending is firstly it's quite interesting to see how many of our customers don't utilize MFA or slightly worrying. So it's is that behavioral change. So firstly get them onto MFA as a concept thereafter move on to the best version. There'll be multiple iterations. It's sort of how when we used to secure devices simply the password and username thereafter MFA came and it's began to

increase. Now the best version of what we have at the moment again it's not bulletproof is 502. So if you can encourage them to start utilizing pass keys or hardware keys, there's a huge drive right now at Cisco for utilizing this. Um, and I don't know, I'm not advocating for Duo or anything in our application, but there's been a lot of changes within our own application. For example, the device now needs to be uh connected via Bluetooth with the device that you're trying to sit connect into. So there's going to be multiple iterations and advancements in this. Um so what I can say is that is the best we have at the moment but as

with technology with anything it will continue to improve. So for now if you can use that but MFA is a good starting point for anybody. Okay that's all we have time for. Thank you.