Episode 30: Why is Multi Factor Authentication (MFA) Important? - with BZ - Welcome To 123 CMMC

Welcome to the Leadership and Success Podcast with your host, Coach BZ. If you need to develop into a better leader, this podcast is for you. If you want to achieve a greater level of success, this podcast is for you. His mentor, Dr. John C. Maxwell, said it best: everything rises and falls on leadership. We hope to inspire you today and provide you with an insight that has the potential to positively impact the trajectory of your life. Welcome to the Leadership and Success Podcast.

This episode is brought to you by SteelRoot, a national leader in helping companies meet cybersecurity compliance requirements and prepare for CMMC. Their experienced team of engineers and consultants assist organizations of all sizes to implement and manage IT systems that meet the technical requirements in DFARS and CMMC. Hello everyone and welcome back to another episode of 123 CMMC. My name is Dana Mantiglia and I will be your host, and our guest today is Bob Zinga. Hi Bob, how are you?

Hey Dana, thank you so much for having me on your show today.

Thank you for offering your time, appreciate it. We have a very exciting topic today. We are going to talk about MFA and security awareness. So let's jump right in. So what is MFA?

So MFA, that's multi-factor authentication, right? So basically in 2021, 21st century, it's pretty much absolutely not acceptable for anybody to be able to log into any systems really without having at least a second factor of authentication. For most people out there, The only control really they have between what they care about, their sensitive or confidential data, and the hackers out there is just their password. That's one factor of authentication. You need to have multiple, at least two for all of the systems you've got. That's really the best security practices today.

You're right. It's something that everybody really needs to start taking seriously because the idea of just having the same password and the same email that everyone uses to log into every single different account and all the data breaches that have been out there, it's out there somewhere. If that's the way you're operating, it's definitely probably been exposed somewhere. So that's it.

Absolutely. The great majority of all the breaches out there, they really exploit two things. One is the password, and number two, phishing. That's pretty much all they do. Yep.

So here's something that some people may not even have thought about. So what is the difference between— how is MFA different from 2FA?

So I guess 2FA is a subset of MFA, right? MFA is multi-factor authentication. 2FA is only, only 2. So when we talk about multi-factor authentication, there are, I guess, 3 known categories. One is something you know, like your password. Another one is something you have. For example, in the military, we all have a CAC card, military card, which we actually have to have in order to be able to access our system. So you put in your card, something you have, and then something you know, your PIN number or your password. So that's two-factor authentication right there. But then there is a third category as well, something you are, like biometrics. For anyone who has like a modern phone or mobile device, they're gonna have like, you know, face scan or fingerprint or anything like that, something you, you are. So those are kind of the three categories of multi-factor authentication, and you need at least two of them for really any systems you log into. Something kind of funny, I think it was maybe 3 or 4 years ago, one of the banks I bank with, I've been with them for quite a while. For whatever reason, they didn't have 2FA for login. All they had is just username and password. I'm like, no, there is absolutely no way I'm going to continue banking with you guys if you don't enable 2FA. I actually shamed them on Facebook, and a few months later they went ahead and gave us at least the option to enable 2FA. Really, in 2021, I'm going to tell you, if your bank doesn't give you the option to enable 2FA, bank somewhere else because your account will eventually get hacked and you're going to lose real, real money.

That is a very, very good point, and that's definitely a good first account to go check on is your banking account. So that's great that you did that and that they actually followed through and said, oh, he's right here, we should probably do this. But that's a good point. Put your money somewhere else if it's not gonna— they don't give you the option to do that. So that's really good. All right, so obviously now, so why is MFA important?

Yes, MFA is extremely important, especially today, because, you know, even if you use a complex password, the long password, like, you know, uppercase, lowercase, special characters, and later eventually, especially with, uh, you know, quantum, uh, computers, which is on the horizon now, it's just going to be a matter of time before anybody who really, really wants to get into your account may be able to break into your password. However, if you have multi-factor authentication, even if they get one of those factors, which is not something you know, your password, they cannot be who you are or they don't have what you've got. So by having a second factor, whether it's a text to your phone or an application that gives you a very unique random code or your fingerprint or your face scan, then even if they break into your password, they still cannot access your data because they only have one factor of several factors to get into the data, if that makes sense. So again, that's why in 2021, and we just celebrated, right, the 18th anniversary for National Cybersecurity Awareness Month last month, October. But really, the message going forward is yes, you absolutely, absolutely have to enable at least 2FA on all of the accounts you are using. Very, very critical.

Yeah, one thing I like to point out too is in addition to the 2FA having the, the multi-factor is because let's say for example you have your phone and someone takes your phone and you don't have a passcode on your phone and they can get right into that phone, they can then start resetting your password or getting the text message for the 2FA. So that's the other thing too, put it, put a lock on your phone, number one, and then having that third application, they wouldn't be able to do that because they are not them. So they would not have something that was them, like a retina scan or something.

So—

Absolutely. And if you have a mobile device, a phone, an iPad, a tablet, absolutely have 2FA. You need to have at least a passcode and some type of fingerprint or face scan or a password, right? Something you are, something you have, and something you know. Very, very, very critical. Because I mean, if you just think about it today, Almost everything we do, we have to have a phone now, right? I can't really imagine life without my phone today. Absolutely my entire digital life is on this little device, right? If this device is lost and somebody is able to get into it, I mean, my life is pretty much over. So it is very important to make sure to keep it safe and secure and update your phone software as well very, very frequently.

It takes 2 seconds to set up, right?

Yes. Do it. Okay.

So now the next one is, are all MFAs equal?

Well, not exactly, especially when you come to the second factor, something you have, right? I think the simplest way of doing that is after you enter in your password, you could get like a text message, like SMS, and then type in the code. One problem with SMS is it's already been broken because people are able to actually use kind of like those SIM cards and exploit them and be able to receive somebody else's text on their phone. So that has already been done. It's not easy to do, but it's already been done. What is even much better than that is if you use an application like Google Authenticator. I love Authy, or Microsoft Authenticator is another one. That's like an actual application where you have to authenticate again and then it gives you the Unicode you need to then access whatever website you are trying to get into. That's much, much more secure than just having a text message. Because if you think about that too, many people, instead of using the phone number they get from their ISP provider, they actually have like Google Voice numbers which you can access from the internet just using your email. So if somebody's able to break into your email, they're going to be able to get that SMS text very, very easy, right? So that's, that's why it's really, really better if you can to use an application like Google Authenticator or Authy and then be able to use that as your second factor on all of the websites you have to log into.

The new Department of Defense's Cybersecurity Program, CMMC, can be very confusing and overwhelming. A3 is a cloud-based collaborative environment for an organization seeking certification. A3 builds CMMC packages and has access to a marketplace of consultants, RPOs, and assessor C3PAOs. A3 creates a roadmap for each cybersecurity requirement and helps break things down step by step. Please visit cyberdataintelligence.com/a3. Yeah, that's really an excellent, excellent point to use something else like that. And you know, one thing people always say when it comes to all this stuff is they say, oh, it takes too long, takes too much extra time, you know? And if they ever stopped and thought about how much time it would take if somebody does get into your accounts and take over your accounts or go in and take your money out. And that's the problem is that no one ever thinks it's ever gonna happen to them. So they say, well, this is gonna waste more time. No, no, no, no, no. Take that time is gonna be time well spent versus the time if you do have somebody that gets in there.

Absolutely. I guess in security what we are doing really is managing risk, right? And when we know for sure that hackers out there breaking into passwords, and 2FA is one little thing that could, you know, protect your confidential information. It's definitely worth it. So I guess we need to change and think of it like risk and reward. If you really enjoy your phone, you enjoy doing online banking, which is very, very convenient, but you want to make sure nobody else gets into your account but you, then it's definitely worth it. Yes, totally agree.

Yeah, absolutely. All right, so when and how often should users complete the SAT? First, explain to us what is the SAT, and then how often should users be completing?

Yes, so SAT, that's the, uh, security awareness training, right? So, um, for most organizations, uh, when you become a new employee, before they give you system access, you have to go through this security awareness training where they tell you about all of the policies and the controls that are in place and what to do and what not to do. What not to do, right, with company equipment and so forth. So for a very long time, the best practice was to do the security awareness training only during onboarding. You did one time and you are done. But that's definitely not good enough because threats do change, right? So like at my company, we celebrate National Cybersecurity Awareness— I mean, National Cybersecurity Awareness Month every single year, since about 3 years ago when I joined, we kind of made it a big deal. So we take that opportunity to every single year really provide additional security awareness training to our users. So it's really something you should be doing during onboarding and once, at least once a year after that. I know in the government, like in the military, we do it every single year, like in October, which is the new fiscal year. Pretty much everybody in, in the Navy is required by December to complete the security awareness training, which I think is very, very good practice.

Yeah, and it's funny when you say that because think about onboarding. Let's say someone's been there for even 7 years, 8 years, in the world's a whole different place when it comes to all that threat stuff. So you're absolutely right, updates and, and the additional reminder that, oh yeah, we got to keep doing this, you know, keep moving forward. So once a year is good, at least once a year, I I suggest. So that was really, really good. So is there anything else you want to throw out there before we wrap it up?

Yes, I guess just one thing I mentioned earlier. Most of the breach we have seen in the last couple of years is really due to people cracking passwords. That's why MFA is extremely important. But also when we talk about security awareness training, I think we need to make security training more interactive and try to make it fun so people actually learn, right? Because security, privacy, was a kind of very, very boring subject, but I think if you can turn it into a game, that would be fantastic. Like, one thing I do at my job, the Navy does that too, from time to time we kind of send phishing campaigns. They are fake phishing emails, but we just want to see if people have actually learned the training or if they're going to be clicking, you know, on attachments and links from emails they really do not expect, and if they do, then they have to take the training all over again. Really try to make it interactive and expose your people so that they are involved in the training where they actually gain new skills. Because, you know, a lot of the bad guys out there, some of them are extremely smart, but I think the great majority are not that smart at all, right? For example, with Microsoft product, we have Patch Tuesday every Tuesday of every month, the first Tuesday of every month. Microsoft tells the entire world, hey, this is what's wrong with my operating system, these are all of the vulnerabilities, and hey, guess what, here is the fix. But for most people, they don't apply the fixes for 6 months, sometimes even a year. So the bad guys have time now to actually go there and exploit those vulnerabilities, right? So many of those hackers are not really much smarter than we are. They just— it's just an opportunity for them to really exploit vulnerabilities that everybody really should know about. So making sure you are patching your system very frequently, I would say at least once every 30 days. Also enabling MFA everywhere it is allowed. And for those few applications that may not have 2FA as an option, you probably need to stop using them. I am really serious. Don't use those applications anymore because eventually they are going to get hacked. And then, you know, do security training at least once every year. Mm-hmm.

Yeah. And yeah, you just brought up a good point. That's a good thing for MSPs to point out to their clients. What, you know, what their patch policy is. And it's a good question for people if you're looking for maybe a new MSP or, you know, you're talking to your CISO or somebody, you know, how often are we doing this? What's our schedule? Like, because, you know, I talk to people all the time about how business owners are not technical people and they don't even know what questions to ask. So if you're an MSP and you could make it as very simple as somebody, you know, can understand and you say, this is our patch, you know, policy, this is our schedule, or however it is, um, that's, as you're saying, that's obviously a very important thing. And as you're saying, Microsoft is announcing every Tuesday, guess what, we found some more.

Exactly.

Well, that's great. Well, I really, really appreciate your time and expertise when it comes to all this. This is very important stuff that we really need to start taking seriously. So thank you very much, Bob, for coming on.

Thank you. I really appreciate the opportunity. Good, good.

And thank everybody for listening and watching, and we hope to see you again on the next episode. Till then, bye-bye.

Thank you for listening to the Leadership and Success Podcast with your host, Coach Beezy. If you like what you heard, please subscribe to our channels and come back for more wisdom nuggets on how you may develop into a better leader and achieve greater levels of success. Leadership is the most critical skill. The world will always need leaders to lead others, deploy the next disruptive technology, or execute a business strategy. You may as well decide on counting yourself among the 21st century leaders. See you right here next time on the Leadership and Success Podcast with Coach BZ.