Huntress Shares Cybersecurity Awareness Tips on MFA, EDR, and Identity Attacks

Summary

Huntress recommends MFA, least-privilege access, strong unique passwords, and caution with payment requests to reduce account compromise and business email compromise risks. It also discusses challenges managing EDR and rising identity-based attacks.

Key points

Enable MFA on critical accounts, especially administrative accounts; the article recommends authenticator apps over text- or email-based authentication.
Use conditional access policies and least privilege to limit access from suspicious devices or locations and restrict access to what employees need.
Use unique, strong passwords and a password manager rather than reusing or storing passwords insecurely.
Huntress says organizations can struggle to manage noisy EDR alerts, while fully outsourced EDR management may be costly.
The article warns that attackers may compromise accounts, reroute invoices, delete originals, and alter payment details as part of business email compromise.
Verify payment requests by phone, scrutinize email addresses and URLs, avoid unsolicited links and attachments, and navigate directly to websites when providing personal information.

Article Details

Defense Focus: Strengthening identity and account security, reducing business email compromise risk, and improving effective management of endpoint detection and response.
Detection Methods: Use conditional access policies to block or scrutinize suspicious or irregular login attempts, including access from unknown or unsupported devices and unexpected network locations.
Scrutinize sender addresses, URLs, spelling, and payment or financial requests in email correspondence.
Verify payment or financial-information requests by phone before acting.
Data Sources: Authentication and login activity, including device and network location
Email messages, sender addresses, URLs, and invoice changes
EDR alerts
Platforms: Endpoint detection and response (EDR)
Defensive Actions: Enforce MFA on all accounts that support it, especially critical applications and accounts with administrative privileges; prefer authenticator apps over text- or email-based codes.
Apply least privilege and restrict access to sensitive data and systems.
Use unique, strong passwords and a password manager; avoid guessed or reused passwords and insecure storage.
Avoid opening unsolicited email attachments or following links, especially when they request sensitive information or urgent action; navigate to websites directly when entering personal information.
Assess the resources, costs, and expertise needed to manage EDR alerts and solutions effectively.