The US Department of Homeland Security has told organizations to replace SMS and voice calls with more secure methods for multi-factor authentication (MFA). SMS and voice are described as ‘particularly vulnerable’ and that the switch to token and app-based authentication should occur ‘urgently’.
Instead, organizations should adopt easy-to-use, secure-by-default, passwordless solutions such as Fast IDentity Online (FIDO)2-compliant, phishing-resistant MFA methods.
This recommendation comes at the top of a 52-page report from the Cyber Safety Review Board (CSRB) about the techniques used by the LAPSUS$ hacker gang and related parties. CSRB is a part of the Cybersecurity and Infrastructure Security Agency (CISA), which bills itself as ‘America’s cyber defense agency’. The essence of the CSRB conclusions about LAPSUS$ was that they succeeded in causing considerable harm using techniques that are simple but effective because they exploit the inherent weakness of widely-used security tools.
The report also says telcos should do more to prevent fraudulent SIM swaps.
The Board also calls attention to the risks introduced through use of mobile devices for authentication and urges telecommunications providers to mitigate risk through technological, process, and oversight measures. Carriers should implement more stringent authentication methods for SIM swapping to continue enabling legitimate business processes while introducing more friction to discourage malicious actors.
It was refreshing to see cybersecurity experts highlight the extent to which security should involve a broader strategy than merely throwing more and more technology at it. Commsrisk has often observed the extent to which boys are attracted to an online underworld that teaches them the tricks of a criminal trade via forums and comms channels that parents and teachers are not familiar with. Reducing crime also means engaging with boys before they start committing crimes.
…the Board recommends the advancement of “whole-of-society” programs and mechanisms to prevent juvenile cybercrime. Congress should explore funding juvenile cybercrime prevention programs, fostering interruption and redirection programs, and reducing criminal incentives by exploring ways to ensure continuity between federal and state law enforcement authorities.
This report is an excellent resource for anyone seeking to understand the key intersections between comms services and cybercrime. You will find it here.
