Cybersecurity Best Practices: Defending Identity, Access, and People

A practical guide for reducing the risk of the attack pattern behind most 2026 breaches

Why this focus

Looking across this year’s major breaches — Aura, Match Group, Abbott/Exact Sciences, Canvas — a single pattern shows up again and again: attackers didn’t need a zero-day exploit. They needed one employee, one phone call, and one set of single sign-on (SSO) credentials. This document covers the practices that directly address that pattern.

1. Move beyond phishable MFA

• Adopt phishing-resistant authentication — FIDO2 hardware security keys or platform passkeys — for all privileged and SSO-connected accounts. Push notifications, SMS codes, and authenticator app codes can all be talked past by a convincing live caller.

• Disable or restrict “push-to-approve” MFA for high-risk roles (IT admins, help desk staff, anyone with SSO or directory access).

• Require number-matching or contextual verification on push-based MFA where hardware keys aren’t yet feasible.

2. Harden the human layer against vishing and social engineering

• Train help desk and IT support staff specifically on voice phishing tactics: attackers impersonating employees or IT staff to request password resets, MFA re-enrollment, or “urgent” access changes.

• Establish a callback verification protocol for any credential or MFA reset request — call the employee back on a known, pre-registered number rather than trusting the inbound caller.

• Run regular social-engineering simulations (phone-based, not just email-based) and treat results as a training opportunity, not a punitive one.

3. Reduce the blast radius of a single compromised identity

• Apply least-privilege access: no single SSO account should be able to reach core systems, marketing platforms, cloud storage, and analytics tools all at once.

• Segment third-party integrations (marketing platforms, analytics tools like AppsFlyer-style services, CRMs) so a compromised employee account can’t pivot freely between them.

• Monitor for anomalous authentication patterns — logins from new devices/locations followed by bulk data exports are a common signature of these attacks and should trigger automatic session review.

4. Clean up legacy and acquired systems

• Maintain a current inventory of systems, databases, and marketing tools inherited through acquisitions. Aura’s 2026 breach traced back to a marketing database from a 2021 acquisition that had never been fully integrated or decommissioned.

• Set a hard deadline (e.g., 90 days post-acquisition) for bringing acquired environments under your identity provider, logging, and monitoring stack — don’t leave them running on legacy credentials indefinitely.

• Periodically audit and delete data that no longer serves a business purpose. Data you don’t hold can’t be stolen.

5. Build detection and response for the “quiet hour”

• Aim for detection and containment within minutes, not hours. In several 2026 incidents, attackers only needed 30–60 minutes of access to exfiltrate meaningful volumes of data.

• Set up real-time alerting on bulk data exports from CRMs, analytics platforms, and file storage — especially from accounts that don’t normally perform bulk actions.

• Maintain a tested incident response plan that includes immediate session revocation, forensic engagement, and law enforcement notification steps.

Quick checklist

☐ Phishing-resistant MFA on all privileged/SSO accounts

☐ Callback verification protocol documented and trained

☐ Least-privilege access review completed quarterly

☐ Inventory of acquired/legacy systems maintained and reviewed

☐ Real-time bulk-export alerting configured

☐ Incident response plan tested in the last 12 months

This guide is intended as general awareness content, not a compliance framework. Pair it with a formal risk assessment for your organization.