Office 365 and Azure Active Directory (Azure AD) customers were the target of billions of phishing emails and brute force attacks successfully blocked by Microsoft last year.
“From January 2021 to December 2021, we blocked over 25.6 billion Azure AD brute force authentication attacks and intercepted 35.7 billion phishing emails with Microsoft Defender for Office 365,” said said Vasu Jakkal, Microsoft vice president for security, compliance and identity.
Multi-factor authentication (MFA) and passwordless authentication would make it much harder for threat actors to brute force their way into their targets’ Microsoft accounts, Jakkal added.
However, even though attackers have steadily increased their breach attempts over the past two years, Microsoft has yet to see the vast majority of its customer base interested in adopting strong identity authentication, including the passwordless authentication and MFA.
“For example, our research shows that across all industries, only 22% of customers using Microsoft Azure Active Directory (Azure AD), Microsoft’s Cloud Identity solution, implemented strong identity authentication protection in December. 2021,” Jakkal said. noted.
“MFA and passwordless solutions can go a long way in preventing a variety of threats and we are committed to educating customers on solutions such as these to better protect themselves.”
Just last week, Microsoft warned of an active, multi-stage phishing campaign using Azure AD to register malicious devices on target networks to distribute phishing emails. As Redmond explained, the attack was blocked on networks where an MFA policy was enabled in Azure AD.
Why Multi-Factor Authentication Matters
Enabling Multi-Factor Authentication (MFA) whenever possible makes it much more difficult, if not impossible, for attackers to pull off an attack and take control of your accounts.
To put things into perspective, Microsoft Identity Security Director Alex Weinert noted that “your password doesn’t matter, but MFA does! According to our studies, your account is over 99.9% less likely to be compromised if you use MFA.”
A joint study by Google, New York University and University of California, San Diego also found that MFA can block up to 100% of automated bots, 99% of mass phishing attacks, and about 66% of targeted attacks .
In August, the US Cybersecurity and Infrastructure Security Agency (CISA) also advised moving to MFA when adding single-factor authentication (SFA) to its list of cybersecurity bad practices.
As CISA explained, hackers can easily gain access to non-MFA-protected systems and accounts because passwords can be easily stolen or guessed using a variety of techniques, including phishing, logging keystrokes, network sniffing, social engineering, malware, brute force and credential attacks. dumping.
Microsoft and Google provide easy-to-follow guides on how to secure your accounts, with Microsoft offering a support page on the five steps to securing your identity and Google a blog post on the five things to do to stay safe online.
Comments are closed.