False sense of security: How attackers swim past your MFA

Multi-Factor Authentication (MFA) has become essential for robust security posture, but not all MFA implementations have the same phishing resistance and end-user experience. This session will explore MFA methods with a focus on their vulnerability to phishing attacks and how organisations can implement the right fit solution for the risks they are managing.

I'll demonstrate live real-world examples of how different MFA methods can be compromised, from traditional time-based one-time passwords vulnerabilities to more sophisticated attacks against notification-based approvals. Through practical demonstrations, attendees will gain clarity on the security hierarchy of authentication factors, from basic knowledge factors to the gold standard of FIDO2 and certificate-based authentication.

The presentation will explore the emerging importance of passphrase-based systems as part of a robust authentication strategy and introduce a practical maturity framework to help organisations strategically transition both workforce and customer identities to more secure authentication methods.

Using concrete examples from Microsoft Entra Sign-In logs, I'll showcase how security teams can leverage SIEM tools to assure their MFA controls monitor MFA implementation and validate that controls are working as intended. These approaches can be easily adapted to other identity providers in heterogeneous environments.

Attendees will leave with actionable insights on the practical security differences between MFA methods, how to identify and mitigate phishing vulnerabilities in current implementations, a structured approach to transitioning to phish-resistant factors, and methods to assure and demonstrate the effectiveness of MFA controls.

This session bridges the gap between theoretical security concepts and practical implementation, providing security professionals with the knowledge to significantly enhance their authentication security posture against evolving threats.