Why Identity Is Your Weakest Link Right Now

The threat landscape in June 2026 makes identity compromise the number-one initial access vector for Australian businesses. A decade-old authentication bypass was just patched in phpBB. Over 400 Arch Linux packages were compromised to steal credentials and access tokens. Oracle is actively mitigating a PeopleSoft zero-day (CVE-2026-35273) exploited in credential theft attacks. Attackers are not hacking in — they are logging in.

The Australian Signals Directorate's Essential Eight lists multi-factor authentication as a core mitigation strategy. NIST SP 800-63-3 explicitly recommends phishing-resistant authenticators at its highest assurance levels (AAL3). CIS Controls v8 dedicates entire control families to identity management and access control. Yet most SMBs still rely on passwords and SMS-based one-time codes.

Here is what you can deploy, starting Monday.

1. Enforce Phishing-Resistant MFA on Every Account

Not all MFA is equal. SMS codes and email verification are vulnerable to SIM-swapping, phishing proxies (like Evilginx), and man-in-the-middle attacks. Phishing-resistant MFA uses cryptographic proof bound to a specific domain, making it impossible for an attacker to relay the authentication even if they intercept the flow.

What qualifies as phishing-resistant:

• FIDO2/WebAuthn hardware keys — YubiKey 5 Series (approximately $55–$75 AUD per key, one-time cost) supports USB-A, USB-C, and NFC. Users simply tap the key during login. No codes to intercept.
• Passkeys — Platform-native FIDO2 credentials stored on devices (Touch ID, Face ID, Windows Hello). Free to deploy on devices your users already own.
• Microsoft Authenticator number matching — While not fully phishing-resistant, enabling number matching and additional context in the Microsoft Authenticator app significantly raises the bar compared to basic push approvals.

Immediate actions this week:

1. Enable MFA for all users in Microsoft Entra ID, Google Workspace, or Okta — no exceptions, including admin and shared accounts.
2. Configure conditional access policies requiring phishing-resistant MFA for privileged roles (administrators, finance, executives).
3. Order YubiKeys for at least your IT admins and senior leadership. Assign two per person so there is always a backup.
4. Disable SMS and voice call as MFA options wherever your identity provider allows it.

Cost: Microsoft Entra ID P1 includes MFA and conditional access at $6 USD per user per month. If you already have Microsoft 365 Business Premium or E3, this is already included in your licence.

2. Deploy Single Sign-On (SSO) and Kill Password Sprawl

Every separate login is a separate attack surface. When employees reuse passwords across SaaS apps, one breach exposes everything. SSO centralises authentication through a single identity provider, giving you one point of control, one audit trail, and one place to enforce MFA.

SSO platform options for Australian SMBs:

Deployment steps:

1. Inventory every SaaS application your business uses. Check each for SAML2 or OIDC support.
2. Configure your identity provider as the SSO hub. Entra ID and Okta both offer application galleries with pre-built integrations for hundreds of apps.
3. Enforce MFA at the identity provider level — not at the application level. This guarantees every app inherits your MFA policy.
4. Provision a password manager (1Password Business at ~$8 USD/user/month or Bitwarden Teams at ~$4 USD/user/month) for accounts that cannot integrate with SSO.

3. IAM Hygiene — Audit, Clean, and Monitor

Dirty identity directories are a compliance and security nightmare. Dormant accounts become ghost entry points. Over-privileged accounts amplify breach impact. Stale service accounts with long-lived credentials are an attacker's dream.

Run this audit this week:

• Dormant accounts: Pull a report of all accounts with no login activity in 30, 60, and 90 days. Disable anything over 60 days. Delete (or archive) anything over 90 days with manager approval.
• Privileged accounts: List every account with admin, superuser, or elevated privileges. Verify each one is assigned to a named individual with a documented business need. Migrate shared admin accounts to individual accounts with just-in-time access (Entra ID P2 Privileged Identity Management at ~$9/user/month handles this).
• Service accounts: Inventory every service account, API key, and application secret. Rotate any credentials older than 90 days. Set expiry dates on all secrets.
• Guest and external accounts: Review every B2B guest account. Remove access for departed contractors and former partners.

CIS Controls v8 (Control 6 — Access Control Management) explicitly calls for establishing and maintaining an access granting and revoking process, and auditing access rights at least annually — quarterly for privileged accounts.

4. Zero Trust Identity Verification — "Never Trust, Always Verify"

Zero trust is not a product you buy. It is a set of principles: never trust any user or device by default, verify every access request continuously, and grant the minimum privilege required.

Identity-focused zero trust controls to implement now:

• Conditional access policies: Require compliant devices (managed, with up-to-date OS and endpoint protection) before granting access to corporate resources. Entra ID Conditional Access and Okta's Device Trust both support this.
• Risk-based authentication: Entra ID P2's Identity Protection uses machine learning to detect anomalous sign-in behaviour (impossible travel, unfamiliar properties, leaked credentials) and steps up authentication automatically.
• Continuous verification: Set session token lifetimes to 1 hour for sensitive applications and 8 hours for standard productivity apps. Require re-authentication for high-risk actions.
• Micro-segmented access: Use group-based access policies so marketing cannot reach infrastructure tools and developers cannot access finance systems.

Quick-Win Checklist: Identity Security Overhaul This Week

• Enable MFA for 100% of users — no exceptions
• Disable SMS and email as MFA methods; enforce authenticator app or FIDO2
• Order YubiKeys for all privileged users (admins, finance, executives)
• Configure SSO for your top 10 most-used SaaS applications
• Deploy a password manager company-wide
• Run a dormant account audit; disable accounts with no login in 60+ days
• Inventory and rotate all service account credentials
• Enable conditional access requiring compliant devices for corporate app access
• Set session token lifetimes to a maximum of 8 hours
• Document the audit — you will need it for Essential Eight and ISO 27001 evidence

FAQ

Conclusion

Identity security is not a future roadmap item — it is something you can meaningfully improve this week. Start with phishing-resistant MFA on every account, centralise authentication through SSO, clean up dormant and over-privileged accounts, and layer on zero trust conditional access policies. The tools are mature, affordable, and well-documented. The frameworks (Essential Eight, NIST SP 800-63-3, CIS Controls v8) give you clear targets to aim for.

Every day without phishing-resistant MFA is a day an attacker can log in as any employee who clicks the wrong link. Fix it now.

Visit consult.lil.business for a free cybersecurity assessment.

References

1. NIST SP 800-63-3: Digital Identity Guidelines — The authoritative US federal standard for digital identity proofing, authentication, and federation, including AAL requirements for phishing-resistant authenticators.
2. ASD Australian Cyber Security Centre — Essential Eight — The ACSC's prioritised mitigation strategies, with MFA as a core control and a three-level maturity model for progressive implementation.
3. CIS Controls v8 — Center for Internet Security — Community-developed security benchmarks, including Control 5 (Account Management) and Control 6 (Access Control Management) with specific implementation groups for SMBs.
4. Yubico — YubiKey for the Essential Eight — Mapping of FIDO2 hardware key capabilities to each Essential Eight maturity level, with deployment guidance for Australian organisations.