The Enhanced Edge

How legacy protocols bypass your MFA

Kristian Wright Season 1 Episode 37

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 23:59

A credential stuffing attack compromised 12 accounts in one client environment using credentials from a 2021 data breach.

• The attacker bypassed MFA on three accounts by exploiting legacy authentication protocols that the tenant had never disabled.

• Access went undetected for 11 days. The attacker downloaded contracts and HR files and set up email forwarding to monitor invoice conversations.

• A SOC analyst reviewing impossible travel alerts caught it before a fraudulent payment was made.

• Seven defenses every MSP should implement now: disable legacy auth, enforce MFA on all accounts, monitor anomalous logins, run quarterly breach checks, configure conditional access, review inbox rules weekly, and alert on new MFA device registrations.

Thanks for listening!

-

Learn more about our full spectrum network security platform for MSPs & MSSPs: enhanced.io