MFA Stops Attacks | Remote Wipe | Data Breach Protection (2024)

Experts from Microsoft, Google, and elsewhere suggest that users who enable multi-factor authentication (MFA) for their accounts end up blocking 99.9% of automated aka bot attacks. DriveStrike proudly supports MFA and highly encourages you to use it everywhere you can!

If a service provider supports multi-factor authentication, we recommend using it, even if the secondary authentication is as simple as SMS-based one-time passwords.

Several security studies show that automated security attacks (the vast majority of cyber attacks) fail when MFA is in place and the cost for attackers rises exponentially as the barriers to their malicious attempts increase.

Google reported: “Our research shows that simply adding a recovery phone number to your Google Account can block up to 100% of automated bots, 99% of bulk phishing attacks, and 66% of targeted attacks that occurred during our investigation.”

Complex and Long Passwords don’t work as well anymore

Inexpensive powerful computing is pervasive which means hackers have access to a vast arsenal of cyber weapons. The old advice of “don’t use a breached password” (lists are available at https://haveibeenpwned.com/) or “use really long complicated passwords” doesn’t help as much anymore.

Cybersecurity experts have proven that despite blocking leaked credentials or enforcing complex long passwords, hackers continue to compromise accounts at an alarming rate.

Start Your Free 30 Day Trial

Each day brings new cybersecurity challenges, so your organization needs simple and wide-reaching solutions to combat those challenges. DriveStrike is here to help you protect your most critical data with premium quality endpoint security. Start a free trial with DriveStrike today, and contact us if you need any assistance. Our team is always ready to answer your questions.

Free Trial

Attack	AKA . . .	Frequency	Difficulty: Mechanism	User assists attacker by . . .	Does your password matter?
Credential Stuffing	Breach replay, list cleaning	Very high – 20+M accounts probed daily	Very easy: Purchase creds gathered from breached sites with bad data at rest policies, test for matches on other systems. List cleaning tools are readily available.	Reusing passwords on more than one account. More than 50% of users reuse their passwords for other systems.	No – attacker has exact password.
Phishing	Man-in-the-middle, credential interception	Very high. ½% of all inbound mails.	Easy: Send emails that promise entertainment or threaten, and link user to cloned site for sign-in. Capture credentials in the process.	People are busy, distracted, curious or worried and drop their guard.	No – user gives the password to the attacker
Keystroke logging	Malware, sniffing	Low.	Medium: Malware records and transmits everything you enter on the keyboard including usernames and passwords entered.	Visiting insecure websites, downloading unvetted software, failing to run virus scans regularly	No – malware captures and sends everything typed.
Local discovery	Dumpster diving, physical recon, network scanning.	Low.	Difficult: Search office or journal for written passwords. Network scan for open shares. Scan for creds in code or maintenance scripts.	Writing passwords down too many to remember; using passwords for other accounts	No – exact password discovered.
Extortion	Blackmail, Insider threat	Very low.	Difficult: Threaten to harm or embarrass unless they give up the goods.	Failing to report.	No – exact password disclosed
Password spray	Guessing, hammering	Very high Millions probed daily.	Trivial: Use easily acquired user lists, attempt the same password over a very large number of usernames and accounts. Throttle speed and distribute across many IPs to hamper detection. Tools are everywhere and inexpensive.	Using common or compromised passwords.	No, with enough time the password is compromised
Brute force	Database extraction, cracking	Very low.	Varies: Penetrate network to extract files. Perform hash cracking on password. Difficulty varies with encryption used.	None.	No, with enough time the password is compromised

Enabling multi-factor authentication blocks 99.9% of these unauthorized login attempts, even if hackers have your current password. Why, because they not only need the password but now a secondary credential that expires. The MFA model requires they figure out your password and the additional security protocol (passcode) and the secondary code must be solved within a few minutes before it changes yet again.

Capturing or compromising MFA tokens is very rare and very expensive. In most cases organizations or malicious actors using these tools only do so for very high value targets.

Bottom line – use Multifactor Authentication to protect your accounts and protect your mobile devices with DriveStrike in case it is lost or stolen you can remotely wipe the device(s) that displays or accesses your MFA credentials!

About Spearstone

Spearstone, 2008 Digital IQ award recipient for IT Security, is a software development company with enterprise customers that include Wells Fargo, Pearson Learning, Logitech, Spacelabs, Sony and RemedyMD. Spearstone’s DriveStrike product provides data breach protection for computers and smartphones, including remote wipe and mobile device management.

Start Your Free 30 Day Trial

Free Trial