Feed Sponsorship Ads

You know the drill: when you go through airport security there are two lines. In one, a TSA agent makes sure you're the person in your passport photo. In the other, a machine scans your carry-on for explosives, weapons, or a normal-sized bottle of shampoo.

Enterprise security is much the same, but instead of passengers and luggage, we're talking about end users and their devices. In the first line, user authentication verifies a user's identity, and it's gotten pretty sophisticated in the past few years, with SSO and MFA becoming more common.

But user devices don't get nearly the same level of attention. The average device trust solution only looks at a handful of endpoint security factors, like OS updates and firewall. If this really were the TSA, that wouldn't even be an x-ray machine, more like holding a bag to your ear and listening for a ticking sound.

And that's assuming an organization looks at end user devices at all. Kolide's Shadow IT report found that 47% of companies let unmanaged devices access their resources, and authenticate via credentials alone.

Unmanaged devices (those outside a company's MDM) can be infected with malware, full of PII, or worse -- they can belong to a bad actor using phished employee credentials.

And hey, there are valid reasons for a device not to be enrolled in MDM. Contractor devices, Linux machines, and employee phones all need to be able to access company resources. But there's plenty of room for middle ground between "fully locked down and managed" and an open-door device policy.

Specifically, companies need device trust solutions that block devices from authenticating if they don't meet minimum security requirements.

Even with phishing-resistant MFA, it's frighteningly easy for bad actors to impersonate end users -- in the case of the MGM hack, all it took was a call to the help desk. What could have prevented that attack (and so many others) was an unspoofable form of authentication for the device itself.

That's what you get with Kolide's device trust solution: a chance to verify that a device is both known and secure before it authenticates. Kolide's agent looks at hundreds of device properties (remember, our competitors only look at a handful). What's more, our user-first, privacy-respecting approach means you can put it on machines outside MDM: contractor devices, mobile phones, and even Linux machines.

Without a device trust solution, all the security in the world is just security theater. But Kolide can help close the gaps. (And we won't even make you take off your shoes.)

To learn more, please watch our on-demand demo.

DetailsPro brings SwiftUI to Apple designers. Without writing a line of code, you can bring your next idea to life in SwiftUI right from your iPhone. An easy interface, built-in templates, and a community of designers sharing files will have you up and running in minutes. Your design is 1:1 SwiftUI so you can export to Xcode at any time. Intuitive features like side-by-side Dark Mode preview and Repeating Elements use the smarts of SwiftUI to make the process enjoyable. DetailsPro is available for iPhone, iPad, Mac, and Vision Pro. It's free forever up to five files.

The September 2023 MGM hack quickly became one of the most notorious ransomware attacks in recent memory. Journalists and cybersecurity experts rushed to report on the broken slot machines, angry hotel guests, and the fateful phishing call to MGM's help desk that started it all.

And, like a slick magic trick, the public’s attention was drawn in the wrong direction. Now, months later, we’re still missing something critical about the MGM hack.

That’s because, for many of the most important questions about the breach, the popular answers are either incomplete or inaccurate. Those include: who hacked MGM, what tactics they used to breach the system, and how security teams can protect themselves against similar attacks.

Why is that a problem? Because it lets us write off the MGM hack as a one-off story, instead of an example of an emerging style of attack that we'll certainly be seeing more of. And that leaves companies and security teams unprepared.

Who hacked MGM?

Plenty of news stories have confidently blamed the MGM attack on either the Scattered Spider or ALPHV hacking group, but the truth is still murky, and likely involves a dangerous team up between different groups, each bringing their own expertise to the table.

Their attacks first use fluent English social engineering skills to get onto networks, where they then deploy sophisticated ransomware that quickly establishes persistence across multiple systems.

What tactics did they use?

The dominant narrative has been that “a single phone call hacked MGM.” A phone vishing attack to MGM’s IT help desk is what started the hack, but there’s much more to it than that. The real issue is that this help desk worker was set up to fail by MGM's weak ID verification protocols, and probably wasn't doing anything "wrong" when they gave the bad actors access to a super administrator account.

How can security teams protect themselves?

Cybersecurity experts have centered most of their advice on user ID verification. But while it's true that MGM's help desk needed better ways of verifying employee identity, there's another factor that should have stopped the hackers in their tracks.

That’s where you need to focus your attention. In fact, if you just focus your vision, you’ll find you're already staring at the security story the pros have been missing.

It's the device you’re reading this on.

To read more of what we learned when we researched the MGM hack -- like how hacker groups get their names, the worrying gaps in MGM’s security, and why device trust is the real core of the story -- check out the Kolide by 1Password Blog.

With WorkOS you can start selling to enterprises with just a few lines of code. It provides a complete User Management solution along with SSO, SCIM, and FGA. The APIs are modular and easy-to-use, allowing integrations to be completed in minutes instead of months.

Today, some of the fastest growing startups are already powered by WorkOS, including Perplexity, Vercel, and Webflow.

For SaaS apps that care deeply about design and user experience, WorkOS is the perfect fit. From high-quality documentation to self-serve onboarding for your customers, it removes all the unnecessary complexity for your engineering team.