Why aren’t you required to input
your password and MFA (multi factor authentication) code every time you open
Outlook?
Is it still safe to use?
You’ve been told that passwords
alone are not a strong enough defence and you have been advised to add a
secondary layer in the form of MFA – an extra code which has to be generated
and input if you want to log in.
You have been diligent in setting up
your security on everything you access, yet it turns out that you are not
required to provide the MFA code every time.
Have you noticed that you can open Outlook whenever you wish and you are
straight in to your inbox? How come the MFA
security level is no longer required?
Fret not! Outlook has remembered your MFA security;
it’s stored in what is known as a TOKEN.
The token allows the program to
remember you and grant you access on one given computer. If you attempt to sign in on a different
machine or via the web app, you have to go back to supplying your security
credentials.
The token represents a pretty nifty
piece of security; swift access to your emails, yet the hackers are still
blocked unless they have your password *and* your MFA code. Good to know that you are protected.
Unfortunately, wherever there is
security, there is a hacker hell-bent on breaking it. As the contents of your Outlook – emails and
contacts – are valuable resources for cyber criminals, this is motivation for your
tokens to be attacked. We have seen
cases where MFA is in place but the token security has not stopped a hacking
attack; the session token is hijacked.
What can you do?
Microsoft offers settings which stop
attacks in their tracks, but these are generally not in the entry-level
versions of their software. It may be
worth considering investing in an upgrade if your business emails are
constantly under fire.
The best measure everyone should
take is to be circumspect and vigilant. Check
emails carefully and don’t click on links, but if you do, don’t supply your
password. Not always possible in a busy
office, to be sure.
You can implement systems to protect
you:
–
spam filters preventing the phishing
email hitting your inbox in the first place,
–
email banners warning you of
suspicious links or unusual senders
–
anti-malware and anti-exploit
protection
–
make sure that all the optional
settings on your Microsoft software provide the maximum security available.
At least if you know that your
systems have this vulnerability, you can stay alert to suspect activity and
call in the IT support experts if you are concerned. Forewarned is forearmed, as the saying goes.
The cybersecurity world is
constantly evolving, so the most important thing you can do for your business
is never to assume that your protection setup is perfect!
As always, take care, stay safe, and
give us a call if anything simply doesn’t look right.
