Security
MFA is not the finish line it used to be
If you have multi-factor authentication on, you are ahead of most small businesses. You are also not finished.
The attacks we see now do not try to break MFA. They wait for it.
Prompt bombing. An attacker with your password from an old breach sends approval requests until someone taps accept at 11pm to make their phone stop.
Adversary in the middle. A convincing login page proxies the real one, lets MFA succeed, then steals the resulting session token and replays it. Your password staying secret does not help.
Three things that actually move the needle:
- Number matching or passkeys instead of tap-to-approve. You cannot accidentally approve a code you have to read and type.
- Conditional access on the session, not just the login. A token lifted in one country and replayed against a Florida tenant should fail a device check.
- A no-blame reporting path. Someone who taps accept by mistake at 11pm needs to be able to say so without feeling stupid. This one is free and it is the one most often missing.
MFA is necessary. It stopped being sufficient a while ago.
More updates
-
Why Phase II paused, according to the announcement
The Department of War cited compliance costs and burden on small business, not assessor capacity. The obligations did not pause with the assessments.
-
Backups rarely fail in a ransomware event. Recovery does.
The backup job is green. The restore is what breaks — usually on recovery order, an encrypted backup server, or a restore time nobody measured.
-
Your contract decides the assessment. Scope decides the effort.
About $593,800 with a third-party assessment, or $388,600 self-assessed. Which applies is set by your contract's requirement, not by how you are configured.