Fortunately, identity security has improved significantly in recent years. Passwords have made way for MFA, and more and more organizations are now deploying phishing-resistant MFA. This makes it much harder for attackers to deceive users during login. That is good news. The less good news: an identity is not automatically secure because of it.
A new security challenge begins after the login
A user can successfully pass through phishing-resistant MFA and gain secure access to Microsoft 365. But what happens next? Suppose an attacker gains access to an active session or manages to obtain a valid token. In that case, the attacker might not need to log in again and therefore doesn’t have to go through MFA verification again. The original authentication was strong. But can you still trust the session after that? That is exactly the question you must keep asking.
A secure login doesn’t mean you’re done
Token theft and session hijacking show that security doesn’t stop once someone has successfully logged in. You also want to know who the user is, which device they are working from, and whether the circumstances during the session are still the same. Conditional Access can help by including more context around an access request. Device binding can strengthen the relationship between identity and device. And with Continuous Access Evaluation, it can be reassessed during an active session whether access is still justified when something important changes. In short, the login is not the endpoint. And there is another crucial question to ask in this context:
How long will what we consider secure today remain secure?
That was one of the interesting questions raised during the Workplace Ninja Summit in Baden. Because while we continue to improve identity security, the landscape is constantly changing. AI plays a dual role in this. It can help attackers work faster and more convincingly, but at the same time, it is being used to better detect and stop attacks.
And then there is the role that quantum computing could play. The remarkable thing about quantum computing is that certain calculations will be performed much faster than with the computers we know today. As a result, cryptographic protections we use today to protect passwords, login credentials, and other sensitive information, for example, could potentially be much easier to crack in the future. We must therefore be vigilant that already stolen data could suddenly be decrypted.
“The challenge lies not only in what we can secure today. The real question is what happens to the data that is stolen today and can be cracked in a few years.”
Kenneth van Surksum – Modern Workplace Consultant & MVP
Security has no endpoint
Phishing-resistant MFA is therefore an important step, but not the final destination. The same applies to a compliant device or a well-configured Intune environment. These are important components of your security foundation, but no guarantee that you are ready for what happens tomorrow.
Keep the conversation going
In the current landscape, standing still is not an option. At Secure at Work, we translate security developments into practice and look together at what you can anticipate today to be compliant and guarantee secure working environments.
Back to Blogs
