10 ms·
The account didn't have any kind of 2fa - even SMS would have stopped this breach. Obviously hardware keys are the gold standard but I wouldn't trivialize the a
by arkadiyt 5y ago
The account didn't have any kind of 2fa - even SMS would have stopped this breach. Obviously hardware keys are the gold standard but I wouldn't trivialize the amount of work it takes to roll that out to an organization.
- Godel_unicode 5y agoI would, it's pretty trivial (I have done it for multiple organizations of different sizes/technical competencies). Especially for something like a VPN; at this point if you use a VPN solution which doesn't support MFA it almost certainly has other security issues as well.
- ineedasername 5y agoI have a family member who had a very junior role at a big finance company 15 years ago and they used hardware keys. Seems like national infrastructure should require similar levels of security.
- qbasic_forever 5y agoFor any sysadmins or future sysadmins reading this though, do NOT put your service's 2FA on SMS. Do not use SMS for anything other than sending your grandparents a happy birthday message. It is trivially broken with a sim card hijack and we have seen many high profile incidents of people being hacked precisely through this vector.
- rossdavidh 5y ago...and yet, it would have been better than this setup.
- kevin_thibedeau 5y agoThese days cheapskate companies will insist on a validator app on employee provided phone rather than take the hit on capital expenditure for a proper key. It would be nice to have legislation that bans that practice.
- bimboler38 5y agoI think legislators will start setting how important it is to protect infrastructure and implement something similar to PCI/DSS.