Is SMS-based MFA still a viable defense against modern SIM swapping social engineering?

All answers to this question.

The short answer is yes: move away from SMS. NIST has been deprecating SMS-based 2FA for years because it’s vulnerable to both SIM swapping and SS7 interception. Social engineering the telco provider is surprisingly easy for a determined attacker. We migrated to app-based TOTP (like Google Authenticator) first, then moved our high-privilege users to FIDO2 hardware keys. Hardware keys are the only true defense against real-time phishing sites that act as proxies. It’s a bigger investment, but the reduction in risk regarding account takeover is massive.

   Answered 2024-02-12 by Linda Rodriguez

While hardware keys are great, how do you handle the logistical nightmare when employees lose their keys or leave them at home while working remotely?

   Answered 2024-02-15 by Steven Taylor

• Steven, we issue two keys per user; one stays on their keychain, and the other is a backup stored in a secure location. If they lose one, we can revoke it instantly in the admin console. For remote workers, we have a cloud-based backup identity verification process that requires a video call with HR.

     Commented 2024-02-18 by Thomas Moore

App-based authenticators are a good middle ground. They are free, easy to deploy, and much harder to social engineer than a mobile carrier's support agent.

   Answered 2024-02-20 by Barbara White

• Barbara is right. Even moving from SMS to a free app like Microsoft Authenticator significantly raises the bar for an attacker without costing the company extra.

     Commented 2024-02-22 by Mark Sullivan