Monday Feb 19, 2024

#169 - MFA Mishaps

In this episode of CISO Tradecraft, host G Mark Hardy discusses various mishaps that can occur with Multi-Factor Authentication (MFA) and how these can be exploited by attackers. The talk covers several scenarios such as the misuse of test servers, bypassing of MFA via malicious apps and phishing scams, violation of the Illinois Biometric Information Protection Act by using biometric data without proper consent, and potential future legal restrictions on biometric data usage. G Mark also highlights the significance of correct implementation of MFA to ensure optimum organizational security and how companies can fail to achieve this due to overlooking non-technical issues like legal consent for biometric data collection.




  • 00:00 Introduction
  • 00:43 Understanding Multi Factor Authentication
  • 01:05 Exploring Different Levels of Authentication
  • 03:30 The Risks of Multi Factor Authentication
  • 03:51 The Importance of Password Management
  • 04:27 Exploring the Use of Trusted Platform Module for Authentication
  • 06:17 Understanding the Difference Between TPM and HSM
  • 09:00 The Challenges of Implementing MFA in Enterprises
  • 11:25 Exploring Real-World MFA Mishaps
  • 15:30 The Risks of Overprivileged Test Systems
  • 17:16 The Importance of Monitoring Non-Production Environments
  • 19:02 Understanding Consent Phishing Scams
  • 30:37 The Legal Implications of Biometric Data Collection
  • 32:24 Conclusion and Final Thoughts

Comments (0)

To leave or reply to comments, please download free Podbean or

No Comments

Copyright 2024 All rights reserved.

Podcast Powered By Podbean

Version: 20240320