📋ISO 27001 A.8.5Rule: ISO27001-A85high

Secure Authentication

Description

Secure authentication technologies and procedures shall be implemented based on information access restrictions and the topic-specific policy on access control.

⚠️ Risk Impact

Weak authentication is the dominant breach entry point. Password-only authentication, missing MFA, and recycled credentials enable the 2024 credential-stuffing wave.

🔍 How EchelonGraph Detects This

ISO27001-A85Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🔧 Remediation

Enforce MFA universally. Eliminate password-only authentication. Adopt passkeys / WebAuthn for high-value systems. Federate authentication through IdP. Deprecate legacy authentication (SAML 1.0, basic auth).

💀 Real-World Attack Scenario

A SaaS company didn't enforce MFA on their admin console. Credential-stuffing attack against leaked credentials yielded 14 valid admin logins in 18 hours. Attackers exfiltrated customer data; cost: $1.8M.

💰 Cost of Non-Compliance

Credential-stuffing breaches: avg $4.45M (IBM 2024). Microsoft data: MFA blocks 99.9% of automated credential attacks.

📋 Audit Questions

  • 1.Is MFA universal?
  • 2.Are passkeys deployed for admin systems?
  • 3.Is legacy authentication deprecated?
  • 4.Show authentication-related audit events.

🎯 MITRE ATT&CK Mapping

T1110.004 — Credential StuffingT1078 — Valid Accounts

⚡ Common Pitfalls

  • MFA optional / advisory
  • MFA enforced for users but not service accounts
  • SMS-based MFA (vulnerable to SIM swapping)

📈 Business Value

Strong authentication is the highest-ROI security investment.

⏱️ Effort Estimate

Manual

16-40 hours for universal MFA rollout

With EchelonGraph

EchelonGraph audits MFA enforcement across cloud + SaaS

🔗 Cross-Framework References

SOC2-CC6.1NIST-IA-2

Automate ISO 27001 A.8.5 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →