Full Report
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. [...]
Analysis Summary
# Best Practices: Closing MFA Gaps in Hybrid Environments
## Overview
These practices address "fragmented authentication," where organizations protect cloud applications (SaaS/M365) with Multi-Factor Authentication (MFA) but leave legacy or infrastructure-level access points (VPNs, RDP, and Windows Domain Controllers) protected by passwords alone. These gaps are primary targets for ransomware affiliates and credential-stuffing attacks.
## Key Recommendations
### Immediate Actions
1. **Audit Active Directory (AD) Passwords:** Use a read-only auditing tool to scan for weak, leaked, or reused passwords within your AD environment.
2. **Identify Non-MFA Entry Points:** Map all external access paths, specifically checking if VPNs and RDP gateways are integrated with your MFA provider.
3. **Disable High-Risk Legacy Protocols:** Shut down unused or unencrypted authentication protocols that bypass modern MFA checks.
### Short-term Improvements (1-3 months)
1. **Enforce MFA for VPN Access:** Ensure all SSL VPN and IPsec tunnels require a second factor, moving away from simple credential-based logins.
2. **Deploy Compromised Password Screening:** Implement a solution that continuously compares AD passwords against a live database of leaked credentials (e.g., 4+ billion compromised passwords).
3. **Harden RDP:** Restrict RDP access to specific internal IPs and require MFA for any RDP session, especially those targeting Domain Controllers.
### Long-term Strategy (3+ months)
1. **Unify Identity Management:** Aim to bridge the gap between cloud MFA and on-premises Windows estates to ensure a consistent security posture across all resources.
2. **Adopt Zero Trust Principles:** Shift from "perimeter security" (VPNs) to identity-aware proxies that verify every access request, regardless of where it originates.
3. **Automated Password Policy Management:** Transition to dynamic password policies that adapt based on the current threat landscape (e.g., NIST-compliant length and complexity).
## Implementation Guidance
### For Small Organizations
- Focus on low-overhead wins: Use free auditing tools to find weak passwords.
- Prioritize MFA for the single most vulnerable entry point (usually the VPN).
### For Medium Organizations
- Implement automated password policy software to reduce the manual burden on IT teams.
- Ensure that departmental file shares (which are common targets for data exfiltration) require MFA-backed authentication.
### For Large Enterprises
- Conduct a comprehensive audit of "shadow IT" and forgotten legacy systems that rely on legacy LDAP/Active Directory without MFA.
- Integrate AI-driven threat intelligence to monitor for password-spraying attempts against global endpoints in real-time.
## Configuration Examples
* **VPN Configuration:** Configure the SonicWall SSL VPN (or equivalent) to use RADIUS or SAML 2.0 to hand off authentication to an MFA provider (like Duo, Okta, or Microsoft Entra ID).
* **AD Policy:** Update Group Policy Objects (GPO) to prevent the storage of passwords using reversible encryption and to enforce modern complexity requirements.
## Compliance Alignment
- **NIST SP 800-63B:** Guidelines for Digital Identity (MFA and password strength).
- **CIS Controls (Control 6):** Access Control Management and MFA enforcement.
- **PCI DSS 4.0:** Requirement for MFA for all access into the CDE (Cardholder Data Environment).
## Common Pitfalls to Avoid
- **The "Cloud-Only" Fallacy:** Assuming that because M365 is secure, the entire network is secure.
- **MFA Fatigue:** Implementing poorly designed MFA that leads to users blindly approving push notifications (consider using "Number Matching").
- **Ignoring Lateral Movement:** Protecting the front door (Initial Access) but failing to require MFA for internal jumps (RDP/Lateral Movement).
## Resources
- **Specops Password Auditor:** `hXXps[:]//specopssoft[.]com/product/specops-password-auditor/`
- **Mandiant Ransomware TTPs Report:** `hXXps[:]//cloud[.]google[.]com/blog/topics/threat-intelligence/`
- **Verizon DBIR:** `hXXps[:]//www[.]verizon[.]com/business/resources/reports/dbir/`