Securing MFA Adoption With Risk Messaging

Many organizations across the Asia-Pacific region continue to rely on outdated authentication methods despite years of warnings from security experts. The obstacles differ based on organizational size, with larger companies hindered by legacy infrastructure investments while smaller entities suffer from awareness gaps.

See Also: Effective Communication Is Key to Successful Cybersecurity

With phishing attacks growing more sophisticated – expanding beyond email to include voice, SMS and now “generative AI tools that will involve a persona speaking to you that might be someone else,” the risks associated with single-factor authentication have multiplied, said Marco Figueroa, senior manager of cybersecurity, risk and compliance at the Australian Institute of Company Directors.

For CISOs struggling to implement multi-factor authentication, the key challenge isn’t technical but communicative. Security leaders must translate technical vulnerabilities into business impacts when addressing executives who control budgetary decisions for security improvements, Figueroa said.

“The best thing that a CISO can do is to be able to present this as a risk or threat for the organization. Senior leaders don’t know about technology [or] about the details of weaknesses and vulnerabilities, but they do understand the language of risk better than anyone else,” he said.

In this video interview with Information Security Media Group, Figueroa also discussed:

• How single-factor authentication remains the biggest vulnerability across organizations of all sizes;
• Why passwordless authentication represents the next evolution in anti-phishing defenses;
• Why regulatory efforts such as the Australian Signals Directorate’s “Essential Eight” haven’t driven widespread adoption.

Figueroa has more than 30 years of leadership experience in cybersecurity, technology risk and engineering across government, former ASX-listed, fast-moving consumer goods with Asia-Pacific operations, and private and educational sectors. He is responsible for providing strategic and tactical direction by engineering sustainable services. Figueroa is a member of the CyberEdBoard.