A company tells its cyber insurer it has MFA. That answer is true. The claim still fails. Julien Richard, VP of Information Security at Lastwall, and Isabel Castillo, Lead InfoSec Operations Engineer at Lastwall, join Martin Hinton to take apart the cyber insurance application's most misleading question.

Why a yes-or-no MFA question collects honest answers and prices nothing. What phishing-resistant authentication actually resists. How attackers take your session instead of your password. Why multi-factor and multi-step are not the same thing. And Richard's proposal for a live control dashboard that could replace the point-in-time audit.

Covered in this episode: multi-factor authentication, phishing-resistant MFA, passkeys and FIDO2, adversary-in-the-middle attacks, session token theft, cyber insurance underwriting controls, security questionnaires, zero trust, least privilege, identity sprawl, and continuous control monitoring.

Chapters

00:16 Introduction to MFA challenges and evolving threats

01:22 MFA Types and Strength

06:13 Why MFA Still Matters

08:49 Common MFA Implementation Gaps

14:09 How Attackers Bypass MFA

23:22 Phishing-Resistant Authentication and Passkeys

29:06 Passkeys, Friction, and Insurance Questionnaires

35:12 Identity Sprawl and Personal Devices

40:04 Zero Trust and Least Privilege

43:58 Evaluating MFA for Cyber Underwriting

48:27 Authentication Logs and Incident Response

53:50 MFA as Part of Layered Security

57:48 Reducing Risk Through Segmentation

1:00:14 Board Questions and Practical Takeaways

1:04:42 Closing Thoughts

The Cyber Insurance News and Information podcast covers the underwriters, brokers and security leaders shaping the cyber insurance market.

Read the full article

Music licensed through Soundstripe. License code: VDAMY4ZV39WWXJII