What have you used to ensure that you have MFA on all externally facing systems and IT services?

Security Strategy & RoadmapSecurity & GRC
499 viewscircle icon1 Upvotecircle icon4 Comments
Sort by:
CISO in Insurance (except health)a year ago

Implementation is dependent on your network architecture, but the general process needs to start with your asset register and prioritization of external / internal interfaces. MFA is something that affects external stakeholder experience and can increase friction in some use cases, so it needs to be agreed with the business.

Ideally you would proxify all inbound connections through a brokered service already offering MFA as standard (the combo Entra + Intune on Azure work for this purpose, but you need well-trained engineers). Do take into account API interface connections if you have them, as well as pre-existing or legacy B2B channels which might pose a challenge.

Whatever your implementation, you will need assurance: incorporate external pen-testing into the mix with the specific scope of detecting non-MFA enabled inbound vectors, then check if the results match your understanding. Much can be learnt with this if done properly.

Group Director of Information Security in Bankinga year ago

This is a five step process to get it right. Someone gets their hands dirty without getting any credits for the effort because that's what was expected by management in the first place. Its a program in itself with each step a project within. if you're inheriting this mess from someone else who hasn't done it this way, all the best 2 u!

1. It starts with having inventory of all applications, both internal and external facing and their underlying stack (Web/OS/DB etc) dependencies.
2. Demarcate them between internal and external facing.
3. Inventorise admin / previleged accounts on both internal and external applications (first) and then underlying stack (second).
4. Push them all into a previleged access (PIM/PAM) solution and its vault.
5. Enable MFA via PAM on all previleged accounts.

The cherry on the cake will be to get all external and internal apps on an SSO solution.

CISO in Governmenta year ago

Force access through an SSO solution that includes MFA, without direct access to an external system you can control how the authentication is provided.

Chief Information Security Officer in Finance (non-banking)a year ago

Great question, top of mind, I'd suggest:
1) Review your Application Inventory and assign App Owner validates MFA (test script or screen shots of config are ideal); an
2) perform a pen test either internally via peer review or externally.  This is a good starting use case for ASM to enumerate all IPs/DNS that have an auth prompt.

I'd like to hear how others have approached as well, the Entra and Intune settings (inclusive of conditional access, App proxy and email) make it complex - it is rather easy to miss an MFA setting here and when engineering right, it is a robust control against credential based attacks. 

Content you might like

I’m looking for a “Ransom Consideration Matrix” to use as a supplement to a ransomware response decision tree. Ideally, it would include factors such as: Reputation Impact Scope of Attack Disruption to Operations Threat Intel / APT Reliability Condition of Backups Long-Term Sustainability of BCP Does anyone have any examples of a graphical decision tree or matrix that incorporates some of these types of elements? This is to include in a playbook.

Which pitfalls—model bias, false positives/negatives, data quality, regulatory constraints—often impede AI-based security tools, and how can they be mitigated in a financial-services context?

Read More Comments

Do you have a person at your company specifically focused on payments (e.g., VP of Payments)?

Yes65%

No35%

Does anyone have any experience with Dune Security? I am in the process of doing an RFP for a vendor to provide phishing simulation and annual training content and their name came up, but I've not heard of them.  My current vendor is KB4.

On a scale of 1-5, how would you rate your organization’s ability to successfully protect your organization's operational network (OT) and IT network from a cyber attack?

1. We are not at all prepared.3%

2. We are somewhat prepared.35%

3. We are moderately prepared.21%

4. We are generally prepared.33%

5. We are highly prepared.6%

View Results