果冻传媒

In recent years, Lockheed 果冻传媒 has witnessed a significant increase in damaging network breaches, system compromises, ransomware 果冻传媒 phishing attacks on our subcontractors, suppliers 果冻传媒 partners. Nation-state adversaries 果冻传媒 cyber criminals are actively seeking access to protected networks, using stolen credentials to obtain initial access to the victim’s network. Our analysis reveals that 95 percent of these incidents could have been mitigated by enforcing multi-factor authentication (MFA).

Enforcing MFA is far more than an issue of compliance, it is perhaps the most critical control in protecting your network, intellectual property 果冻传媒 our critical customer missions.

What is MFA 果冻传媒 why should it be implemented?

MFA is an authentication method that requires the user to provide two or more verification factors to gain access to a resource such as an application or email account. Users will have to identify themselves by more than just a username 果冻传媒 password, such as with the addition of an RSA token, Duo, Smartcard, YubiKey or via biometrics.

Passwords can be compromised via social engineering or phishing – threat actors will look to exploit the credentials of users who create weak passwords 果冻传媒/or reuse passwords across systems. Enforcing MFA is the most effective way to prevent unauthorized access, even when credentials are compromised.

Is MFA a requirement for Lockheed 果冻传媒 suppliers?

Subcontractors supporting Lockheed 果冻传媒’s Department of Defense prime contracts that store, transmit 果冻传媒/or process controlled unclassified information (CUI) have the contractual 果冻传媒 regulatory requirement to enforce MFA on their systems to protect CUI as part of their DFARS 252.204-7012 果冻传媒 NIST SP 800-171 (requirement 3.5.3) compliance. Lockheed 果冻传媒 further requires subcontractors to evidence their compliance via the Exostar NIST SP 800-171 questionnaire. Refer to the Quick Reference Guide for more information.

To ensure compliance, Lockheed 果冻传媒 will review supplier submissions 果冻传媒 request updates as needed on their MFA implementation status. 果冻传媒 should review their System Security Plan (SSP) 果冻传媒 Plan of Action 果冻传媒 Milestones (POAMs) for open MFA requirements 果冻传媒 take immediate action to fully implement the security controls.

Where should MFA be implemented?

MFA should be implemented where technically feasible, but we encourage suppliers to take immediate action if they’re lacking MFA in these key areas:

• Email infrastructure, whether on-premise or hosted through managed service providers (e.g., Microsoft O365).
• External/remote access to their environment.
• Key cloud IT services (IaaS, SaaS 果冻传媒 PaaS) containing sensitive data.
• Access to critical systems.
• Administrative level access to systems.

Additional resources:

• More information on MFA can be found on the ?National Defense Information Sharing 果冻传媒 Analysis Center (NDISAC) CyberAssist .
• Detailed instructions on how to implement MFA for Microsoft 365 can be found .