Azure MFA – How to Prevent Your Organization from being the Victim of a Phishing Scam

Hello there Exigo Insight faithful and welcome back! We’re glad you’re here. Today, we are going to cover a topic that is becoming all too common into today’s cyber world – Phishing scams. In the past couple of years, these scams have become far more rampant across the globe, and many companies, large and small, have fallen victim. So today, we will discuss Azure’s Multi-factor Authentication (MFA) solution, and how it can help protect your organization from falling victim to this ever growing threat.

Before we being, let’s look at a scenario that would best describe a situation that would call for MFA:

You are an IT admin. You are heading to work on what should be a typical Tuesday (or whatever day it may be for you). You sit in traffic, grab your favorite coffee or energy drink, and pull into the parking lot to discover that you must park on the other side of the campus, and walk to the front door, in the pouring rain. To top it off, you forgot your umbrella at home.

You sit at your desk, and open your email client and see that you have an email marked as urgent. It’s from the CFO He/she is frantic, asking you to call them immediately. Just as you are about to call, your CIO calls you and says “YOU NEED TO GET DOWNSTAIRS TO THE BOARD ROOM!” You don’t know what’s going on, but your CIO meets you in the hallway and explains the situation:

Over the weekend, the CFO received an email, saying that there was a parcel waiting for them. There was a link in the email that should have gone to the tracking information. But what it went to was a malicious website. Boom! Malware infected the machine. Passwords were stolen, and now it seems that there were successful attempts to log into the companies SharePoint portal, where sensitive information lay in wait for the remote attacker.

You walk into the board room. The President, CEO, and all shareholders are there. They look at you and the CIO and ask “HOW DID THIS HAPPEN? WHY DON’T WE HAVE ANY METHODS IN PLACE TO CIRCUMVENT THIS????”

Nowadays, this story has become all too common. Whether the attacks are from the outside, or from a disgruntled employee on the inside, securing your data is a must. The days where secure passwords, firewalls, and state of the art anti-malware solutions are gone.

This is scary. How do you stop it? You’ve have everything you could possibly need to prevent this, but there is one exception: a power user. That’s right. No matter how much you educate the end user, it’s hard to keep them abreast of all the nasty security vulnerabilities that are out there. It’s not their fault. It’s not their job to keep up with IT security and possibly threats.

In a world where everyone now has a phone, an email, or some sort of app, there are now ways to use them to your advantage. That my friends, is Multi-Factor Authentication.

So what is Multi-Factor Authentication?

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to “something you have”, “something you are”, and “something you know”.

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless. A good example of this is the two-step authentication required by Gmail. After providing the password you’ve memorized, you’re required to also provide the one-time password displayed on your phone. While the phone may appear to be “something you have”, from a security perspective it’s still “something you know”. This is because the key to the authentication isn’t the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP (over the phone) configuration, an attacker could successfully impersonate you without stealing anything physical.


So what is Azure Multi-Factor Authentication?

Azure Multi-Factor Authentication (MFA) is Microsoft’s two-step verification solution. Azure MFA helps safeguard access to data and applications while meeting user demand for a simple sign-in process. It delivers strong authentication via a range of verification methods, including phone call, text message, or mobile app verification.

Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected.

  • Easy to Use – Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks.
  • Scalable – Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom apps. This protection is even extended to your high-volume, mission-critical scenarios.
  • Always Protected – Azure Multi-Factor Authentication provides strong authentication using the highest industry standards.
  • Reliable – Microsoft guarantees 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification

So what can it do?

When a user signs in, an additional verification request is sent to the user. The following are a list of methods that can be used for this second verification.

Phone call

A call is placed to a user’s phone asking them to verify that they are signing. Press the # key to complete the verification process. This option is configurable and can be changed to a code that you specify.

Text message

A text message is sent to a user’s smart phone with a 6-digit code. Enter this code in to complete the verification process.

Mobile app notification

A verification request is sent to a user’s smart phone asking them complete the verification by selecting Verify from the mobile app. This occurs if app notification is the primary verification method. If they receive this notification when they are not signing in, they can report it as fraud.

Verification code with mobile app

The mobile app on a user’s device generates a verification code. This occurs if you selected a verification code as your primary verification method.

For the mobile app verification methods, Azure Multi-Factor Authentication works with third-party authentication apps for smart phones. However, we recommend the Microsoft Authenticator app, which is available for Windows PhoneAndroid, and IOS.

  • Azure MFA can secure the following services in an on-premises deployment:
  • ADFS
  • IIS
  • Windows Authentication (to a workstation or server)
  • LDAP Authentication
  • Remote Desktop Services
  • VPN

There are also advanced configurations that can allow for user self-service functionality.

Ok, but what if I want to use this On-Premises instead of just in the Cloud?

Great question!

Yes, you are correct. This is an Azure based product. However, the only thing you need is an Azure tenant. That’s right, you heard me. An Azure tenant and MFA subscription. You do not have to sync any users to Azure, nor do you have to create any servers in Azure or any other types of IaaS features. This solution, however, is extendable to Azure if you ever need it in the future.

Beyond the technical functionality that the first two implementations provide, an implementation—hybrid by default—with this product offers:

  • On-premises MFA Server implementation An on-premises Multi-Factor Authentication Server offers the ability to help secure Virtual Private Networks (VPNs), Active Directory Federation Services (AD FS), Internet Information Services (IIS)-based web applications, Remote Desktop and other remote access applications using RADIUS, and LDAP authentication.
  • Granular Multi-Factor Authentication When using the Active Directory Federation Services (AD FS) adapter, granular enforcement of Multi-Factor Authentication can be achieved based on Claims Issuance Authorization rules that contain combinations of groups, network locations, browsers, and operating systems.
  • Reporting This feature reports on sign-ins from unknown sources, sign-ins from multiple geographies, and sign-ins from unknown sources.

Azure Multi-Factor Authentication is based on the cloud model. Updates and upgrades are free of charge and communicated beforehand.

So In Conclusion…

Azure MFA is a great multi factor solution. Where you are all for the cloud, or want to keep you important services on-site, Azure MFA can help combat today’s ever increasing password security threat.

Attacks are occurring more often, and weak or stolen user credentials remain the primary entry point for hackers, which is why authentication must be included in your overall security plan. It’s hard enough to keep track of every threat and every new phishing attempt that’s current out in the wild, and it’s even harder ensuring that your users are safe while online as well. Multi-factor authentication is a best-practice approach to help keep user data secure and keep your organization out of the headlines.