‘Urgently’ Transition Away from SMS and Voice 2FA, Warns US Cyber Safety Review Board

The US Department of Homeland Security has told organizations to replace SMS and voice calls with more secure methods for multi-factor authentication (MFA). SMS and voice are described as ‘particularly vulnerable’ and that the switch to token and app-based authentication should occur ‘urgently’.

Instead, organizations should adopt easy-to-use, secure-by-default, passwordless solutions such as Fast IDentity Online (FIDO)2-compliant, phishing-resistant MFA methods.

This recommendation comes at the top of a 52-page report from the Cyber Safety Review Board (CSRB) about the techniques used by the LAPSUS$ hacker gang and related parties. CSRB is a part of the Cybersecurity and Infrastructure Security Agency (CISA), which bills itself as ‘America’s cyber defense agency’. The essence of the CSRB conclusions about LAPSUS$ was that they succeeded in causing considerable harm using techniques that are simple but effective because they exploit the inherent weakness of widely-used security tools.

The report also says telcos should do more to prevent fraudulent SIM swaps.

The Board also calls attention to the risks introduced through use of mobile devices for authentication and urges telecommunications providers to mitigate risk through technological, process, and oversight measures. Carriers should implement more stringent authentication methods for SIM swapping to continue enabling legitimate business processes while introducing more friction to discourage malicious actors.

It was refreshing to see cybersecurity experts highlight the extent to which security should involve a broader strategy than merely throwing more and more technology at it. Commsrisk has often observed the extent to which boys are attracted to an online underworld that teaches them the tricks of a criminal trade via forums and comms channels that parents and teachers are not familiar with. Reducing crime also means engaging with boys before they start committing crimes.

…the Board recommends the advancement of “whole-of-society” programs and mechanisms to prevent juvenile cybercrime. Congress should explore funding juvenile cybercrime prevention programs, fostering interruption and redirection programs, and reducing criminal incentives by exploring ways to ensure continuity between federal and state law enforcement authorities.

This report is an excellent resource for anyone seeking to understand the key intersections between comms services and cybercrime. You will find it here.

Eric Priezkalns
Eric Priezkalns
Eric is the Editor of Commsrisk. Look here for more about the history of Commsrisk and the role played by Eric.

Eric is also the Chief Executive of the Risk & Assurance Group (RAG), a global association of professionals working in risk management and business assurance for communications providers.

Previously Eric was Director of Risk Management for Qatar Telecom and he has worked with Cable & Wireless, T‑Mobile, Sky, Worldcom and other telcos. He was lead author of Revenue Assurance: Expert Opinions for Communications Providers, published by CRC Press. He is a qualified chartered accountant, with degrees in information systems, and in mathematics and philosophy.