Credential theft surged by 160% in 2020, contributing to one in five data breaches as attackers employed AI-driven attacks to bypass traditional defenses. The challenge for security teams has evolved from simply verifying identities to verifying them securely without creating friction for legitimate users.
### Use Strong, Fatigue-Resistant Multi-Factor Authentication
Multi-factor authentication (MFA) remains one of the most effective ways to strengthen identity verification and reduce the risk of account compromise. Rather than relying solely on a password, MFA requires users to verify their identity using two or more factors from different categories: Something you know, such as a password or PIN. Something you have, such as a smartphone, authenticator app, or hardware security key. Something you are, such as a fingerprint or facial scan.
According to NIST guidance, MFA is strongest when it combines factors from separate categories. A password paired with a hardware token or authenticator app provides significantly stronger protection than relying on multiple knowledge-based factors like passwords and security questions. However, MFA isn’t immune to exploitation, with weaker implementations susceptible to attacks like prompt bombing and SIM swapping.
To improve resilience against these techniques, organizations should:
* Move away from legacy SMS or email-based one-time passcodes (OTPs), which are more vulnerable to interception, phishing, and social engineering attacks.
* Prioritize phishing-resistant MFA methods, including FIDO2 security keys, passkeys, or certificate-based authentication.
* Use authenticator apps that generate local OTPs rather than push-based approval prompts where appropriate.
### Secure the Service Desk from Social Engineering
Helpdesks remain a frequent target for social engineering attacks because they sit at the intersection of identity, access, and urgent user requests. Attackers impersonate employees to convince support staff to gain access to accounts, typically through a reset request. These attacks are increasingly sophisticated, with threat actors using AI-enabled deepfake audio or publicly available information to make requests appear legitimate.
Specialized solutions like Specops Secure Service Desk embeds secure identity verification directly into helpdesk workflows, requiring users to verify their identity through trusted authentication methods before password resets, MFA changes, or other sensitive actions can be completed. This helps support teams handle requests securely and reduces the risk of attackers bypassing controls through social engineering.
### Bring Device Trust into Identity Verification Decisions
Modern identity verification can’t rely on credentials alone. Alongside valid credentials, attackers steal session cookies and MFA tokens to break the authentication process and make it harder to distinguish legitimate users from compromised accounts based purely on login details. That’s why more organizations are bringing device trust into authentication and access decisions.
Device trust helps security teams verify not just who is attempting to log in, but what they’re logging in from. Instead of treating every device equally, trusted access policies evaluate signals such as:
* Whether the device is corporate-managed or unmanaged
* Operating system version and patch status
* Presence of endpoint protection or EDR tools
* Device certificates or cryptographic identifiers
These signals add valuable context to identity verification workflows. For example, a login from a recognized, compliant device on a corporate network may require minimal friction. The same credentials used from an unmanaged device or suspicious IP range could trigger step-up authentication, restricted access, or a blocked session entirely.
### Conclusion
Implementing secure identity verification practices is crucial for modern cyber resilience. By following these five best practices, organizations can strengthen their defenses against account compromise and data breaches.
Source: Original article