The Cybersecurity and Infrastructure Security Agency (CISA) added the use of single-factor authentication for administrative or remote access systems to its list of “bad practices” that they consider more risks as when it comes to cybersecurity.
Single-factor authentication is a common authentication method, but with very low security. It is only necessary to match a password with a username to gain access to a system; which makes it especially dangerous for all organizations.
Attackers could steal user login credentials through a variety of proven tactics ranging from phishing and social engineering attacks to the use of brute force attacks and keylogging malware. Once you get the usernames and passwords, breaking a system is not that difficult. Therefore, CISA recommends via advertisement, refer to their “stronger authentication methods” configuration guide for excellent guidance on how to configure much stronger authentication.
In addition, the security agency also highlighted its malpractice website, where it includes:
- Using unsupported or end-of-life software
- Using known/fixed / default passwords and credentials
Enter We Live Security to learn more.
