Episode #10
Why "Do You Have MFA?" Is the Wrong Question
A company tells its cyber insurer it has MFA. That answer is true. The claim still fails. Julien Richard , VP of Information Security at Lastwall, and Isabel Castillo , Lead InfoSec Operations Engineer at Lastwall , join Martin Hinton to take apart the cyber insurance application's most misleading question. Why a yes-or-no MFA question collects honest answers and prices nothing. What phishing-resistant authentication actually resists. How attackers take your session instead of your password. Why multi-factor and multi-step are not the same thing. And Richard's proposal for a live control dashboard that could replace the point-in-time audit. Covered in this episode: multi-factor authentication, phishing-resistant MFA, passkeys and FIDO2, adversary-in-the-middle attacks, session token theft, cyber insurance underwriting controls, security questionnaires, zero trust, least privilege, identity sprawl, and continuous control monitoring. Chapters 00:16 Introduction to MFA challenges and evolving threats 01:22 MFA Types and Strength 06:13 Why MFA Still Matters 08:49 Common MFA Implementation Gaps 14:09 How Attackers Bypass MFA 23:22 Phishing-Resistant Authentication and Passkeys 29:06 Passkeys, Friction, and Insurance Questionnaires 35:12 Identity Sprawl and Personal Devices 40:04 Zero Trust and Least Privilege 43:58 Evaluating MFA for Cyber Underwriting 48:27 Authentication Logs and Incident Response 53:50 MFA as Part of Layered Security 57:48 Reducing Risk Through Segmentation 1:00:14 Board Questions and Practical Takeaways 1:04:42 Closing Thoughts The Cyber Insurance News and Information podcast covers the underwriters, brokers and security leaders shaping the cyber insurance market. Read the full article Music licensed through Soundstripe. License code: VDAMY4ZV39WWXJII
