Unsupported software, standard usernames and passwords, and one-factor authentication have been described by the U.S. Cybersecurity and Infrastructure Agency (CISA) as three of the most dangerous cybersecurity behaviors that all organizations should avoid.
The use of one-factor authentication – where users only have to enter their username and password – is the latest dangerous behavior added to the list, as CISA warns that one-factor authentication for remote or administrative access to systems that support the operation of critical infrastructure is “dangerous and significantly increases the risk to national security.”
The CISA recommends the use of multi-factor authentication to prevent over 99 percent of cyberattacks. MFA is particularly important for critical infrastructures to prevent cybercriminals from exploiting cyber-physical systems.
Along with one-factor authentication as a dangerous practice is the use of known, fixed or standard passwords. Default or simple passwords are good for threat actors because they can more easily guess passwords to gain access to accounts.
The third bad practice listed by CISA is the use of unsupported software or end-of-life software in critical infrastructures. Software or operating systems that no longer receive security updates present a greater risk that cybercriminals could exploit security vulnerabilities that arise when old software often does not receive security patches.
For more information, view the original story from ZDnet.