Lessons learned

This week has seen successful cyber attacks against some of the world's biggest technology companies as well as the UK's National Health Service. Among the key lessons; even the most sophisticated users can be fooled and never, ever allow a browser to save important passwords.

Kudos to Cisco for a very comprehensive report on how it was breached. The key issue was that attackers obtained access to an employee's personal Gmail account. The employee had stored their work credentials in their browser which meant they were synced to Google and so available to the attackers. To access Cisco's internal network, they still had to overcome the barrier of multi-factor authentication. They achieved that by bombarding the employee with authentication notifications until one was accepted, "either accidentally or simply to attempt to silence the repeated push notifications they are receiving.”

Two other high-profile attacks affected two-factor authentication provider Twilio, and content delivery network, Cloudflare. Twilio was breached, Cloudflare wasn't. The difference was the hardware security keys issued to every Cloudflare employee. As we've been reporting, attackers are increasingly using techniques that defeat most forms of two-factor authentication except those using a FIDO-2 compliant security key. They include a number of features that prevent an attacker impersonating the genuine user. They're not always popular but there's no question they work. Cisco and Cloudflare's incident reports have great summaries of what they've learnt from the attacks.