Multi-Factor Authentication: The Bare Minimum of IAM

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

AF Group CISO Seth Edgar shares which security activities are making the greatest difference in his security program via the Agent of Influence cybersecurity podcast.

Wiz, a founding participant in CISA's Secure by Design initiative, details its pledge progress—no-cost SAML 2.0 SSO, mandatory MFA for direct logins, no default passwords, and least-privilege service accounts.

An engagement walkthrough: root access via Apache NiFi, recovered NIS hashes and Duo Auth Proxy secrets, decrypted MFA traffic, then a DA MSSQL relay via xp_cmdshell to domain admin and DCSync.

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.

Based on dozens of mainframe assessments, NetSPI's 2025 State of the Platform report covers MFA adoption, DES-to-AES cryptographic modernization, and persistent security gaps in enterprise mainframes.