[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-5":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-5","Annex A 8.5","ISO\u002FIEC 27001:2022 Annex A 8.5: Secure authentication",15,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects secure authentication technologies and procedures to be implemented, based on information access restrictions and the topic-specific access control policy. Its purpose is to make sure a user or system is securely authenticated when it is given access to systems, applications and services.\n\n**In practice.** Good practice means choosing authentication strength according to the sensitivity of the system, with multi-factor authentication for remote access, privileged accounts and important cloud services, and phishing-resistant methods where risk is high. Log-on procedures limit information shown before success, protect against brute force and log failed attempts. Auditors look for authentication standards, configuration evidence in identity providers and coverage reports for multi-factor authentication.\n\n**Common gaps.** Common gaps are legacy protocols that bypass multi-factor authentication, exceptions for executives or service accounts and applications outside single sign-on.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":23,"title":24,"published_at":25},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":27,"title":28,"published_at":29},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":31,"title":32,"published_at":33},"auth-flaw-in-microsoft-titan-exposes-173-trillion-data-rows","Auth Flaw in Microsoft Titan Exposes 17.3 Trillion Data Rows","2026-09-29T12:21:08.395+00:00",{"slug":35,"title":36,"published_at":37},"default-passwords-on-service-accounts-fuel-microsoft-365-compromise","Default Passwords on Service Accounts Fuel Microsoft 365 Compromise","2026-09-24T10:21:44.924+00:00",{"slug":39,"title":40,"published_at":41},"sms-based-mfa-retirement-demands-urgent-migration-to-phishing-resistant-auth","SMS-Based MFA Retirement Demands Urgent Migration to Phishing-Resistant Auth","2026-09-21T14:20:26.775+00:00",{"slug":43,"title":44,"published_at":45},"french-hospital-fined-500k-after-524000-patient-records-exposed","French Hospital Fined €500K After 524,000 Patient Records Exposed","2026-09-16T14:21:37.111+00:00",{"slug":47,"title":48,"published_at":49},"1m-gdpr-fine-for-weak-call-center-identity-verification","€1M GDPR Fine for Weak Call Center Identity Verification","2026-09-16T08:22:39.767+00:00",{"slug":51,"title":52,"published_at":53},"23andme-fined-24m-after-credential-stuffing-attack-exposes-genetic-data-of-spanish-users","23andMe Fined €2.4M After Credential-Stuffing Attack Exposes Genetic Data of Spanish Users","2026-07-24T16:20:55.147+00:00",{"slug":55,"title":56,"published_at":57},"kratos-phishing-kit-bypasses-mfa-by-stealing-live-session-cookies","Kratos Phishing Kit Bypasses MFA by Stealing Live Session Cookies","2026-07-22T08:21:10.138+00:00",{"slug":59,"title":60,"published_at":61},"iberdrola-fined-1m-for-weak-phone-based-identity-verification-allowing-unauthorized-account-changes","Iberdrola Fined €1M for Weak Phone-Based Identity Verification Allowing Unauthorized Account Changes","2026-07-08T12:21:25.825+00:00",{"slug":63,"title":64,"published_at":65},"lithuanian-medical-company-fined-450k-for-weak-access-controls-exposing-patient-data","Lithuanian Medical Company Fined €450K for Weak Access Controls Exposing Patient Data","2026-07-08T08:20:37.765+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",10,{"slug":73,"name":74,"problem":75,"stories":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",7,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,{"slug":83,"name":84,"problem":85,"stories":86},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",3,{"slug":88,"name":89,"problem":90,"stories":86},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":92,"name":93,"problem":94,"stories":95},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,[97,102,107,113,118,122,124,129],{"family":98,"item":99,"code":100,"title":101,"together":9},"gdpr","32","Article 32","Security of processing",{"family":103,"item":104,"code":105,"title":106,"together":9},"cis","6","Control 6","Access Control Management",{"family":108,"item":109,"code":110,"title":111,"together":112},"nist-800-53","ac-2","AC-2","Account Management",11,{"family":108,"item":114,"code":115,"title":116,"together":117},"ia-5","IA-5","Authenticator Management",8,{"family":98,"item":119,"code":120,"title":121,"together":117},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":103,"item":119,"code":123,"title":111,"together":76},"Control 5",{"family":125,"item":126,"code":127,"title":128,"together":76},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":108,"item":130,"code":131,"title":132,"together":133},"ia-2","IA-2","Identification and Authentication (Organizational Users)",6]