Earlier this year, in June, the US Cybersecurity and Infrastructure Security Agency (CISA) launched a new project called “Bad Practices” that consisted of a catalog of non-recommended cybersecurity practices, techniques, and configurations.
The initial list only included two entries, but in an update today, CISA officials added a new “bad practice” to their list—namely, the use of single-factor authentication for remote or administrative access systems.
“Single-factor authentication is a common low-security method of authentication,” the agency said in a press release today. “It only requires matching one factor—such as a password—to a username to gain access to a system.”
Instead, CISA recommended that organizations check its guide for implementing strong authentication [PDF], where multi-factor authentication is the recommended method of securing not only internet-connected accounts but also accounts of any kind.
CISA Bad Practices catalog
Currently, the CISA Bad Practices catalog includes the following entries:
Use of unsupported (or end-of-life) software.Use of known/fixed/default passwords and credentials.Use of single-factor authentication for remote or administrative access to systems.
Other bad practices CISA officials are currently considering adding to their catalog include the likes of:
Using weak cryptographic functions or key sizes.Flat network topologies.Mingling of IT and OT networks.Everyone’s an administrator (lack of least privilege).Utilization of previously compromised systems without sanitization.Transmission of sensitive, unencrypted/unauthenticated traffic over uncontrolled networks.Poor physical controls.
Security experts can also recommend other “bad practices” via this GitHub page.
The post CISA adds single-factor authentication to its catalog of ‘Bad Practices’ appeared first on The Record by Recorded Future.
Source: Read More (The Record by Recorded Future)
