Don't Use SMS for 2FA

Using SMS text messages for two factor authentication is no longer considered a best practice.

Forbes Magazine published an article entitled, Why You Should Stop Using SMS Security Codes—Even On Apple iMessage, and CNET posted an article Do you use SMS for two-factor authentication? Here's why you shouldn't .

Wired Magazine notes that a security expert believes, "two-factor authentication using SMS text messages isn't technically two-factor at all."

In January 2020, the Department of Computer Science and Center for Information Technology Policy at Princeton University published the results of a research project, An Empirical Study of Wireless Carrier Authentication for SIM Swaps, which concluded that, "users of websites relying on SMS-based MFA continue to be at risk—in some cases severely."

Cell phones can be vulnerable to phishing attacks that lead service providers to direct texts to different SIM cards. The New York State Department of Consumer Protection has posted a warning about scams which aim to switch SIM cards to new devices. The Princeton Study, "identified weak authentication schemes and flawed policies at 5 US mobile carriers from the prepaid market. We showed that these flaws enable straightforward SIM swap attacks."

International mobile subscriber identity-catcher (IMSI) are mobile towers set up for malicious reasons to intercept text messages.

Malware can also be installed on smartphones which will intercept codes used for 2FA.

Using a token or an authentication app that generates temporary codes are better alternatives. Google Authenticator will generate temporary 8 digit passwords.

Cross Domain Solutions

A cross domain solution is a system which is designed to allow two network domains (a single domain being servers with a common login) to securely exchange data. A CDS will include a content filter to prevent data from being moved which another domain does not have authorization to use.

Domains with different levels of access to secure information need a means to both manually and automatically transfer data. A CDS will offer:

1. Access solutions - the ability to view information from domains with differing security levels.

2. Transfer solutions - the ability to move information between domains with differing security levels.

3. Multi-level solutions - the storage of all data in a single domain.

The SANS Institute has prepared a diagram that shows how cross domain solutions work:

See the SANS Institute guide, Shedding Light on Cross Domain Solutions, posted here.

The HITECH Act

Health Information Technology for Economic and Clinical Health Act 42 U.S.C. §§300jj, et seq. (2009), the HITECH Act, was passed to encourage the use of health information technology.

Under the Act, healthcare organizations covered by HIPAA have to report data breaches which concern more than 500 people to the Department of Health and Human Services and the victims of the breach themselves, as well as give public notice of the breaches.

The Act also gives an individual the right to request a copy of their electronic health records (EHR).