Tip of the Week: How to Keep MFA Fatigue from Being a Security Vulnerability

We are major advocates for multi-factor authentication, but it’s also important to understand that it’s not a catch-all solution. In fact, it has forced cybercriminals to be even more innovative to find alternative methods of attack. One method hackers use to gain access to your systems is to use what’s called MFA fatigue to their advantage.

Let’s take a look at what MFA fatigue is and what you can do about it.

MFA Fatigue is a Fancy Name for a Specific Type of Social Engineering

If one of your applications asked you to log in from your mobile device, you wouldn’t think twice about it. You would probably just accept the notification, even if it’s spamming you, maybe due to a “glitch in the system” or some other excuse. Admit it; you would probably confirm the login just to get the notifications to go away.

MFA helps you keep an account secure even in the event your password is stolen, and by adding in additional methods of authentication, MFA is supposed to make it harder for hackers to break into your accounts. If a hacker does plug in your credentials, you’ll still receive the notifications on your smartphone or in your email asking you to confirm the login.

So, if you receive what appears to be a legitimate authentication prompt, would you simply confirm it? Even knowing that it could be a hacker attempting to break into your account? What if that notification appeared over and over and over and over again?

How to Identify MFA Fatigue

Here are some of the dead giveaway signs of MFA fatigue attacks:

• If you receive approval requests without attempting to log into an application.
• If you receive multiple requests from a single application.
• If you receive authentication request notifications at odd hours.

How to Address the Threat of MFA Fatigue

Thankfully, there are ways to protect yourself from the threats posed by MFA fatigue-based attacks. If you have a strong password to begin with, you can keep your accounts secure from MFA fatigue by virtue of them being difficult to guess. Your team also needs to be aware that MFA fatigue attacks actually exist and can pose a problem for your organization. Simply put, if it’s unidentified, then the request should be denied.

Let Us Help You with Network Security

Techworks Consulting, Inc. can be your trusted network security source. To learn more, reach out to us at (631) 285-1527.