Phishing and Credential Theft: The Fastest Path to ERP Breach
Phishing and Credential Theft is becoming more and more convincing, which is why credential theft remains a top way intrusions start. Verizon’s 2024 DBIR found the human element (things like phishing, misuse, and error) in 68% of breaches, and IBM’s 2024 Cost of a Data Breach report shows phishing as a leading initial vector (≈15%) and among the costliest to remediate. In practical terms: once an attacker has a password, they move quickly—often in minutes—to turn that beachhead into access you didn’t intend.
A Real World Breach Example and What It Teaches Us
- The Colonial Pipeline Attack: The Colonial Pipeline attack began with a single, inactive VPN account that didn’t have MFA enabled, which attackers used to gain network access. This intrusion led to the shutdown of the largest fuel pipeline in the United States, disrupting gasoline, diesel, and jet fuel supplies to much of the East Coast. The company paid a $4.4 million ransom (some later recovered) and faced significant operational downtime, supply chain chaos, and public trust damage. What’s the lesson here? Password-only authentication is a breach waiting to happen.
- Broader Trend Line: The FBI/IC3 has repeatedly warned about payroll diversion scams targeting HR/ERP portals, again driven by credential theft. MFA won’t stop every BEC variant, but it raises the bar and can block many direct logins with stolen passwords.
Risk vs. Benefit – Why MFA Still Punches Above Its Weight
MFA breaks the “stolen-password → instant access” chain, slowing or halting account takeovers and helps preserve audit integrity and accountability (who did what). This is directly aligned with SOX authentication control objectives and NIST 800-53 IA-2 requirements for multi-factor authentication for privileged (and, ideally, all) accounts.
Zero Trust
Zero Trust assumes no implicit trust—every user trying to access the environment is verified, every time. MFA is a core enforcement point in NIST’s Zero Trust model: verify explicitly, use strong authentication, reduce lateral movement.
Reducing Lateral Movements and ERP Armor: Assessments
Reducing lateral movement starts with designing roles around the principle of least privilege, granting users only the access required for their job and nothing more—minimizing the damage a malicious actor could cause if they gain entry. Even with MFA in place, you should still plan to limit the blast radius if an account is compromised. This means tightening access to high-risk permissions, eliminating inter-role and intra-role SoD conflicts unless effective mitigating controls are in place, enforcing reasonable session timeouts, and setting up alerts for high-signal events such as changes to bank details, vendor master records, payroll data, or application workflows. By constraining access and closely monitoring sensitive activities, you reduce the attacker’s potential payoff, even if they make it past the first line of defense. ERP Armor: Assessments can help ensure your access controls are top-tier, so your ERP environment is locked down against both internal and external threats.
What To Do When You Find Accounts / Roles Without MFA
- Identify & Verify: Inventory all accounts and roles without MFA enabled. Validate if there is a legitimate business need—assume “no” by default unless explicitly justified and documented.
- Compare Against Policy: Review the current MFA configuration and compare it directly to your organization’s security policy and compliance requirements (SOX, NIST, internal IT standards).
- Engage Key Stakeholders: Share findings with relevant IT leadership, security teams, and NetSuite system administrators to confirm whether any exceptions were approved and still valid.
- Investigate Root Cause: If audit logging is available, determine when and how the MFA requirement was disabled, and by whom. In NetSuite, where there is no native audit log for the Two-Factor Authentication Roles page, rely on custom auditing or external monitoring to assist in the investigation.
- Revert and Remediate: Immediately re-enable MFA for any roles found to be out of compliance, ensuring changes are implemented in accordance with your role design and access control policy.
- Strengthen Controls: Based on your findings, implement or enhance preventative measures—such as restricting who can modify the Two-Factor Authentication Page, setting a workflow over the MFA configuration page, if possible, and adding monitoring or custom alerts to detect future deviations.
- Certify and Communicate: Perform a formal certification to confirm all roles and accounts now meet MFA requirements. Document the incident, corrective actions, and control changes. Communicate lessons learned to all relevant teams to reinforce the importance of MFA compliance.
Bottom Line
Today’s phishing is fast and relentless; credential theft is still a prime breach trigger, and MFA is the most immediate, high-impact control to stop it. Universal MFA closes one of the most common path to ERP takeover, fraud, and data theft.