One remote portal without MFA
Change Healthcare’s attackers walked in through a remote-access portal with no MFA. Check every login page you expose.
Last week Change Healthcare’s CEO told the US Senate how the February attack started: stolen credentials used on a remote-access portal that didn’t have MFA. Nine days later came the ransomware. The outage hit pharmacies and hospitals across the country.
One login page. No second factor.
Most companies have a portal like that somewhere. Not the main email login, which IT protected years ago, but the forgotten ones:
- An old Citrix or remote desktop gateway.
- A VPN profile created for a vendor.
- The admin panel of the website, the firewall or the backup system.
- A web app for one department that still has its own logins.
This week: list every page on the internet where someone can type a username and password. For each one, either put MFA in front of it or take it off the internet. If MFA really isn’t possible, restrict it to known IP addresses and watch its logins closely.
MFA everywhere except one place is MFA nowhere, as far as the attacker is concerned.