Multifactor authentication is not enough to protect cloud data

A cybercriminals group known as UNC5537 has been on a tear.

Over the past month, the ransom gang, possibly related to ShinyHunters or Scattered Spider, stole more than 560 million customer records from Ticketmaster and posted it for sale on its reconstituted leak site, BreachForums, on May 28, asking for $500,000. Two days later, the group claimed to have stolen 30 millions account records from Spain-based Santander Bank, asking for a cool $2 million. Both companies acknowledged the breaches after the postings.

The cause of the data leaks — and at least 163 other breaches — appears not to be a vulnerability but the use of stolen credentials and poor controls on multifactor authentication (MFA), according to a June 10 analysis by incident-response firm Mandiant, part of Google.

“Mandiant’s investigation has not found any evidence to suggest that unauthorized access to Snowflake customer accounts stemmed from a breach of Snowflake’s enterprise environment,” Mandiant stated in its analysis. “Instead, every incident Mandiant responded to associated with this campaign was traced back to compromised customer credentials.”

While the theft of data from Snowflake’s systems could have been prevented by MFA, the companies’ failures go beyond the lack of that single control. Businesses using cloud services need to make sure that they have visibility into their attack surfaces, quickly removing the accounts of former employees and contractors and reducing the avenues through which opportunistic attackers could compromise systems, networks, or services, says Chris Morgan, senior cyber threat intelligence analyst at cloud-native security platform provider ReliaQuest.

“The biggest lesson learned is that threat actors do not need to employ sophisticated techniques,” he says. “Targeting the low-hanging fruit — in this case, insecure credentials — can be achieved with little effort from the threat actor but provides ample opportunities.”

Here are five lessons from the latest spate of cloud breaches.

1. Start With MFA and Then Go Beyond

There is a lot of room for growth in the adoption of MFA. While 64% of workers and 90% of administrators used MFA, according to a report released a year ago, more than six out of every 10 organizations have at least one root user or administrator without MFA enabled on an account, according to Orca Security’s “2024 State of Cloud report.”

Businesses need to get to a consistent — and verifiable — 100%, says Ofer Maor, co-founder and chief technology officer at cloud-security firm Mitiga.

Companies should “make sure MFA is enforced and required, and if using [single sign-on], make sure non-SSO login is disabled,” he says. “Go beyond traditional MFA [and] turn on additional security measures, such as device- [or] hardware-based authentication for sensitive infrastructure.”

To read the complete article, visit Dark Reading.