3 ms·

I can't believe this is not more mainstream. I really appreciate CISA putting it in writing so I can start citing. But seriously, isn't this OBVIOUS? I was tod

I can't believe this is not more mainstream. I really appreciate CISA putting it in writing so I can start citing. But seriously, isn't this OBVIOUS? I was today facing an issue with my BANK because they're locking me out of my account. The reason? I travel around the world and sometimes SMSs won't make it. Also, it's extremely easy to exploit. You can steal someone's phone number with just a bit of social engineering (at least in Europe's carriers). Also, you can steal a phone, remove the sim card, and it'll work anywhere (yes, you can password protect SIM cards, but not everybody does it).

happytoexplain 2y ago
>But seriously, isn't this OBVIOUS? Please don't take this too personally, but this attitude, which I see reasonably frequently, is mind-boggling to me. The answer to "isn't <insert nearly any infosec> obvious?" is - obviously - no. In fact, lamenting aloud how obvious it is is a form of insecurity, because you are discouraging normal humans from asking questions or seeking advice. Unless of course you are implicitly referring only to tech-savvy people, but the default audience for end-user infosec advice is all humans.
datadrivenangel 2y ago
Business people can ignore security people wanting to improve things. Much harder to ignore the security people saying "Per CISA, our security posture does not meet standards" Even better when this gets into an audit checklist in 18-24 months and the security person can say "We will fail our next audit if we don't make this change"