Hackers breached Colonial Pipeline using compromised password
Yes, MFA would have helped here, but I think it&#x27;s besides the point. I&#x27;ve worked on a lot of projects, including one for a major stock exchange, and I&#x27;ve never seen perfect security. It&#x27;s too slow. Even if you had MFA for the VPN, it doesn&#x27;t stop local malware from being able to use the foothold to gain access to the network once the MFA is cleared. I&#x27;m not saying that MFA is useless, just that these types of things are very hard to get right and we only hear about the times the attackers got through. &quot;Oh they should have done X&quot; where X is any one of an increasingly long list of possible things they should have done ranging from security headers on their website, to MFA, to auditing their third party libraries, to locking down their development machines and networks (during Covid, ha!) it&#x27;s never ending. The very best at it get by without total calamity, but the long tail of organizations just don&#x27;t have the right staff, focus, or resources to do it.<p>Edit: I&#x27;m not saying it&#x27;s right! I don&#x27;t think it is right, and I&#x27;ve worked with governments to bring in regulations in certain industries, but to characterize this all on one failure kinda misses the point. There is a broader, harder problem that I&#x27;m not sure is even solvable.