- Published
- Source
- AWS Security Blog
- Filed under
- Cloud, Identity
The Australian Signals Directorate (ASD) has this month issued a clear call to action through its Multi-factor authentication: Switch it on campaign, urging businesses, organisations, and individuals to enable multi-factor authentication (MFA) across their online accounts. At AWS, we strongly support this message. As threat actors continue to target credentials through phishing, credential stuffing, and…
Protecting sign-ins
- Phishing-resistant multi-factor authentication – passkeys or security keys – for administrators first.
- Block the old sign-in methods that skip MFA, and review who can grant apps access to your data.
- Alert on impossible travel, newly added MFA methods and unusual consent grants.
More helpNCSC: multi-factor authentication for online services (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Brute Force
Credential AccessWhat a defender checks
- Look for many failed sign-ins across many accounts from a few addresses – that's password spraying.
- Block legacy authentication, which skips MFA.
- Use smart lockout and a banned-password list.
Build the skillBlue Team Analyst · Identity & Access Monitoring
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst · Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Engineer
Build the controls that stop the next one.
Blue Team Engineer: 28 live classes configuring identity, endpoint, email, network and cloud security in your own Azure and Microsoft Defender tenants – then evidencing it against CIS and NIST CSF, and defending every decision. For people with IT, cloud or SOC experience.
- Conditional Access, PIM and tiered admin
- CSPM, Azure Policy and a landing zone
- Detection engineering and SOAR playbooks
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
