Authentication

The Claim Under Test If your password and your TOTP seed live in the same 1Password vault, unlocked by the same master password, you are running two-step verification (2SV), not multi-factor authentication (MFA). Same secret store, same unlock event, same attacker who now has both factors the moment they get one. This isn’t a hot take. It’s already worked out, published, and ignored, largely because PCI DSS Requirement 8.3 only mandates two factors from two categories, not factor independence or phishing resistance, and most cyber insurance underwriting still treats SMS OTP as an acceptable floor for standard users, even as carriers increasingly downgrade or reject it for privileged accounts. It’s really the same reason why faxing in the USA is considered acceptable for patient health data: HIPAA’s Security Rule requires reasonable and appropriate administrative, technical, and physical safeguards for transmitting e-PHI, not a specific transmission technology, so fax was never excluded and never got re-evaluated once better options existed. Not because either is safe or secure: because it’s legacy knowledge enshrined in permanance. The compliance bar and the security bar diverged years ago for MFA and 2SV; the industry kept building to the compliance bar. ...

This week, I implemented several critical security measures in Azure Active Directory (now Microsoft Entra ID) that every organization should consider. Let’s walk through the key implementations: 1. Break Glass Account Setup Break glass accounts are emergency access accounts that help maintain access during identity system failures. Here’s how to set one up: Create a dedicated emergency access account Store credentials securely (I used a password manager) Configure exemptions from Conditional Access policies Share access with minimal required administrators Document the process and access procedures 2. Conditional Access for Admin Roles Implemented stronger MFA controls for administrative roles: ...