How Businesses Can Strengthen Their Cyber Defences with Zero Trust Security
Why traditional cyber security models no longer work. A global law firm recently suffered a cyberattack that compromised client-sensitive documents…
Read the article →The Cost of Weak Password Security
What happened
A global consulting firm recently suffered a data breach after an employee’s credentials were stolen. The attacker gained access to the employee’s Microsoft 365 account using a password found in a previous data leak.
Once inside, the cybercriminal sent fraudulent emails, exfiltrated sensitive data, and installed malware on the company’s cloud environment—all without triggering any security alarms.
The firm had strong firewalls, endpoint security, and encryption, but one missing security layer left them vulnerable: Multi-Factor Authentication (MFA).
This attack could have been easily prevented if the firm had enforced MFA, an essential security measure that blocks 99.9% of account compromise attempts.
What is Multi-Factor Authentication (MFA)?
MFA requires multiple forms of verification before granting access to an account. Instead of relying solely on a password, users must provide at least two of the following factors:
- Something You Know – A password or PIN.
- Something You Have – A mobile device, security key, or authentication app.
- Something You Are – Biometric verification (fingerprint, facial recognition).
Even if an attacker steals a password, they won’t be able to access the account without the additional factor.
Why Businesses Need MFA Now More Than Ever
Cybercriminals using sophisticated AI attacks exploit weak passwords and login credentials to gain unauthorised access to business accounts. MFA significantly reduces these risks by ensuring only verified users can access sensitive data.
- 1
Protects Against Phishing & Credential Theft
Employees often fall victim to phishing attacks that trick them into revealing passwords. MFA prevents stolen credentials from being used to access business systems.
The fix- Enforce MFA across all business accounts, especially Microsoft 365 and financial systems.
- Use phishing-resistant authentication methods like security keys or biometric verification.
- Deploy Microsoft Defender for Office 365 to detect and block phishing attempts.
- 2
Reduces the Impact of Data Breaches
If a cybercriminal obtains an employee’s credentials from a dark web leak, they can’t use them without the additional authentication factor.
The fix- Require passwordless authentication for high-privilege accounts.
- Enable Microsoft Entra ID Identity Protection to detect and block risky login attempts.
- Monitor compromised credentials using dark web monitoring tools
- 3
Enhances Security for Remote & Hybrid Workforces
With employees accessing business systems from multiple locations and devices, MFA ensures that only verified users can connect to sensitive data.
The fix- Implement Conditional Access policies to enforce MFA based on location, device, and risk level.
- Require Microsoft Authenticator app or FIDO2 security keys for remote logins.
- Restrict access to trusted devices and managed endpoints only.
How to Set Up MFA for Microsoft 365
Step 1: Enable MFA in Microsoft Entra ID (formerly Azure AD)Configure MFA settings for all users.
Step 2: Choose Authentication MethodsRequire Microsoft Authenticator, SMS codes, or security keys.
Step 3: Enforce MFA for All UsersEnsure all employees must verify their identity at login.
Step 4: Implement Conditional AccessRequire MFA only in high-risk login scenarios.
Step 5: Monitor & Audit MFA UsageTrack login attempts and identify any unauthorised access attempts
Best Practices for Implementing MFA in Businesses
- Use Adaptive MFA PoliciesRequire MFA only for high-risk activities instead of every login.
- Train Employees on MFA UsageEducate staff on how to set up and use authentication apps.
- Regularly Review MFA Security LogsIdentify suspicious login attempts and block unauthorised access.
- Enforce MFA on Third-Party IntegrationsSecure external apps connected to Microsoft 365.
- Enable Passwordless AuthenticationUse biometrics, hardware security keys, or mobile authentication instead of passwords.
Conclusion: MFA is the Easiest Way to Prevent Account Breaches
Without MFA, stolen passwords can easily lead to full-scale cyberattacks. Businesses must enforce multi-factor authentication across all accounts, ensuring cybercriminals can’t access sensitive systems, even if credentials are compromised
Written byDaniel Avinir
Co-founder of Solid Systems, helping businesses keep their Microsoft environments secure since 2003.