In the last year, 64% of higher education organizations have fallen prey to ransomware virus attacks. Not only technology has evolved in leaps and bounds but also cyber security threats. They are more advanced and continue to threaten the education niche. Facts indicate the contemporary response mechanisms and security protocols may not be enough to protect you from these advanced cyberattacks. 

One such widely trusted method of security — MFA or Multi-factor Authentication to is not the surest pathway toward data security any more. The primary reason for that is human errors. Hence, data security specialists and technology mavens prepare to take humans out of the equation as much as possible when it comes to handing the key to security. Phish-resistant multi-factor authentication is one such attempt.

Why MFA is not the ultimate tool for security?

Multi-factor authentication is an added layer of security to access accounts, devices, data, and systems. It has become one of the most common yet, reliable solutions to ensure security in modern software systems. Leaving traditional usernames and passwords behind. 

But eventually, cyberattackers found a way around MFA. New types of cyber attacks such as social engineering, eavesdropping, man-in-the-middle attacks, weak verification between components, weak default configuration settings, physical attacks like copying of fingerprints, and more emerged. 

New Type of Cyberattack Doing Round in the Education Industry

Social engineering is a new type of cyberattack that is doing rounds in the education industry. Social engineering of which has been very successful in helping cyber attackers to get through the MFA barrier. 

This is done through an MFA fatigue attack. An attacker steals the login credentials and inundates a targeted victim with MFA push notification sent via text, phone, or email. The attacker hopes the victim would accept the request or it directly calls the targeted victim impersonating someone from IT and get the authentication code. This coerces the user to accept the MFA request. 

So, MFA itself is not a weak method of security assurance, but human nature, and gullibility or lack of knowledge of technology lead to people falling prey to these attacks. 

Switching to Phish-resistant MFA 

Since, vigilance and awareness cannot be completely trusted with the security of the data, experts have created a better security feature. This is Phish-resistant MFA. The new technology is immune to attackers intercepting or tricking users into revealing information. It is similar to traditional MFA only it does not use people to authenticate the access but hardware and devices to validate who you are. 

Phish-resistant MFA removes the concept of OTPs, instead, the authentication is almost entirely done between your device and website. Access to unauthorized or unrecognizable devices thus is evaded. 

Setting up Phish-Resistant MFA for your university

Talk to your ERP vendor about FIDO/WebAuthn and PKI-based MFA. Get more details about both and decide what is the best option for you. Think about which implementation phase is most important for your institute. Look at the type of resources you want to protect and identify which users are more likely to be targets of an attack. 

One step closer to data security 

Technology would continue to evolve and so would cyber attacks. The best protection is to stay abreast with modern technology trends and new methods of securing data in your institute. 

As phishing continues to threaten higher education institutes, think about implementing Phish-resistant MFA. Moreover, educate the stakeholders in your institute about data security and commonly used phishing methods. Teach them methods to identify phishing attacks and update your systems as needed. Also, go with Cloud ERP solutions for the education industry rather than on-premise solutions. 

Related posts: