Forest Global Training Partners

Cyber Risks · Krebs on Security

Microsoft to Require Multi-Factor Authentication for Cloud Solution Providers

Summary: Microsoft said it will soon require all Cloud Solution Providers in its CSP program, along with Control Panel Vendors and Advisor partners, to enforce multi-factor authentication for all users in their partner tenants and to adopt a secure application model for API integration with Microsoft, with enforcement rolling out over the next several months. The change follows attacks on CSP employees and contractors, including an incident in which intruders broke into PCM Inc., the world's sixth-largest CSP, through an employee account that was not using multi-factor authentication, and then accessed the email and documents of PCM customers.

Key Takeaway: A company that partnered with PCM only to get cheaper licensing was unaware that a PCM employee or contractor held full administrative access to all of its employees' email and documents in Office365, and when that employee's account was hacked, so were many other PCM customers.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related