{"id":131131,"date":"2023-08-08T09:00:00","date_gmt":"2023-08-08T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=131131"},"modified":"2023-12-06T16:05:04","modified_gmt":"2023-12-07T00:05:04","slug":"boost-identity-protection-with-axiad-cloud-and-microsoft-entra-id","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/08\/08\/boost-identity-protection-with-axiad-cloud-and-microsoft-entra-id\/","title":{"rendered":"Boost identity protection with Axiad Cloud and Microsoft Entra ID"},"content":{"rendered":"\n
This blog post is part of the Microsoft Intelligent Security Association <\/em>guest blog series<\/em><\/a>. <\/em>Learn more about MISA<\/em><\/a>.<\/em> <\/p>\n\n\n\n Passwords are a security weakness and phishing attacks to exploit accounts protected by passwords are on the rise. The last 12 months have seen an average of more than 4,000 password attacks per second an almost threefold increase from the previous year, a phishing continues to be the preferred attack method by cybercriminals.1<\/sup> Clearly, better solutions are needed to help reduce reliance on passwords and increase security. Phishing-resistant multifactor authentication methods like certificate-based authentication (CBA) are proven to increase account security while decreasing reliance on passwords. Microsoft studies found that your account is more than 99.9 percent less likely to be compromised if you use multifactor authentication.2<\/sup> The power of Axiad Cloud complements Microsoft Azure Active Directory, now Microsoft Entra ID<\/a>, with Axiad CBA for identity and access management (IAM) to prevent common phishing attacks by provisioning and managing phishing-resistant, passwordless credentials for users everywhere. Together, Axiad and Microsoft enable customers to secure entities, enhancing security and reducing IT complexity.<\/p>\n\n\n\n Multifactor authentication fatigue has become increasingly popular among bad actors in recent years. Multifactor authentication fatigue involves flooding user authentication apps with push notification requests to authorize a sign-in. The goal is to frustrate users to the point where they accept one of the approval notifications typically to get the notifications to stop. Once that occurs, the attacker can gain access to the victim\u2019s account. Sometimes these attacks become more sophisticated and add a social engineering or spear phishing component where an attacker will pose as an IT or help desk employee to a targeted victim and ask the victim to approve authentication through an app or ask for the victim\u2019s one-time password (OTP) code. Both techniques can result in an organization losing money and damaging its reputation to remediate the attack.<\/p>\n\n\n\n One example of a high-profile multifactor authentication fatigue attack is the ridesharing platform breach by Lapsus$, a hacking group notorious for their social engineering attacks, that occurred in September 2022. According to an article by Infosecurity Magazine, one of the documents included in the breach may have contained email addresses and information for more than 77,000 employees.3<\/sup> <\/p>\n\n\n\n As IT environments become more complex and multilayered to combat cybersecurity attacks, authentication processes for applications, operating systems, and workplace locations are increasingly managed in silos. This leaves IT teams overwhelmed and organizations vulnerable to the attacks they are working to avoid.<\/p>\n\n\nThe rise in cyberattacks<\/h2>\n\n\n\n