El CEO de Ciberseguridad (y por qué la mayoría de las empresas aún lo hacen mal)

Tenfold Security article cover image of a security lock on a glass surface surrounded by keys, with several keys highlighted in red to represent how attackers can bypass multi-factor authentication (MFA) through Microsoft Entra ID security gaps.

Publicado el 23/02/2026

Autor: Calvin Worst

Biografía

TL;DR

MFA Bootstrapping allows attackers to register their own authentication methods after gaining initial account access, potentially bypassing existing security measures.
Micosoft Entra ID (the login system behind Microsoft 365) has a common configuration gap that makes this bypass easy—even for companies who pay for advanced security plans.
The fix is a single policy: "Securing Security Info Registration." A Conditional Access Policy that takes about fifteen minutes to turn on to restrict security to registered networks and trusted users.

Tabla de contenidos

El Problema del CISO Que Nadie Quiere Admitir

Un CFO Antes de Que Existiera la Contabilidad

La Corta y Brutal Vida de un CISO

El CISO ya Está Actuando Como un CEO

La Ciberseguridad Afecta a Todos los Departamentos

Lo Que los CISOs Realmente Necesitan Para Tener éxito

La Compensación Debe Estar a la Altura Del Riesgo

“Ser CISO hoy es como ser CFO antes de que existiera la contabilidad.”

Esa frase, parafraseada por Patrick Gray de Risky Business a partir de una declaración de Alex Stamos, ex-CISO de Facebook y Yahoo, se acerca incómodamente a la realidad. Eres responsable de proteger la empresa, la marca, los clientes y, en algunos casos, incluso la infraestructura nacional. Todo esto sin contar con un conjunto de reglas universalmente aceptado.

Y, a diferencia de las finanzas, solo llaman la atención sobre tu trabajo cuando algo sale mal.

Business Email Compromise: An attack that targets company email accounts. This is often to redirect payments, steal data, or further access by impersonating an employee.

Close

Spear Phishing Campaign: A series of highly personalized, fake messages that attempt to trick victims into providing sensitive information. For example, an employee receives an email that appears to come from their cell provider, which directs them to a fake login page.

Close

El problema del CISO que nadie quiere admitir

Uno de los primeros pasos para crear un programa de ciberseguridad resiliente es nombrar a un Director de Seguridad de la Información (CISO).

El segundo paso, y posiblemente el más importante, es hacer que esa persona reporte directamente al CEO.

Cuando el liderazgo de ciberseguridad queda subordinado al departamento de TI, el riesgo permanece invisibles hasta que explota.

Mailbox-related attacks, namely Business Email Compromise (BEC), have become increasingly common across the modern threat landscape—whereby attackers often employ spear phishing campaigns to capture employee credentials. But that's what MFA is for, right? Multifactor Authentication is supposed to be the gold standard for protecting company accounts; it's arguably the most critical, bare-minimum control to be enforced by any self-respecting IT department.

...But what if your MFA solution isn't enough? What if it's insecure by default, to the point that it compromises your entire authentication chain?

In this first installment of The Worst Bytes, we cover how your Microsoft Entra configurations are making it even easier for attackers to compromise your environment.

Un CFO antes de que existiera la contabilidad

Imagine pedirle a un CFO que proteja financieramente a la empresa antes de que existieran los Principios de Contabilidad Generalmente Aceptados (GAAP).

Sin estándar de reglas. Sin medidas universales. Sin un consenso sobre cómo se ve una buena gestión.

Esa es la realidad del CISO.

A pesar de los marcos de referencia, las directrices de cumplimiento y los estándares, la ciberseguridad aún carece de reglas universalmente aplicadas. Los CISOs se ven obligados a tomar decisiones que pueden poner fin a carreras, a menudo con información incompleta y prioridades empresariales que compiten entre sí.

MFA Bootstrapping is a technique attackers use to ensure their access to target resources. Using various methods, they will register their own MFA method after breaking into an account. Once they own a trusted authentication method—e.g. Text or Call—most systems will treat them just like a regular employee.

This is how our client got hit—the attacker used a stolen password, accessed a user's account, and registered their own method, giving them reliable, ongoing access to sensitive resources.

Thankfully, the Tenfold team caught on before the attacker could wreak total havoc. But afterward, we still wanted to know how this happened, and how to help other businesses avoid the same gap. As it turns out, this kind of attack is usually aided by simple misconfigurations—not a new vulnerability in Microsoft's software.

MFA Bootstrapping: MFA Bootstrapping is when an attacker, after stealing a user’s password, registers their own device as that user’s MFA method.
‍
‍This technique has a lot of other names, which all sound like they belong in a spy movie or maybe the Situation Room. MFA Arbitrage was the runner up. The only reason I didn’t choose it was because I lack neither the tailored suit nor security clearance to justify my name under a headline about it.

Close

La corta y brutal vida de un CISO

La expectativa de vida profesional de un CISO se parece más a la de un peleador de UFC que a la de un ejecutivo tradicional.

Es estresante. Es público. Y cuando algo sale mal, a menudo eres el primero en irte, incluso si la causa principal fueron años de poca inversión o advertencias ignoradas.

La ciberseguridad es uno de los pocos roles ejecutivos en los que el éxito se ve como si nada hubiera sucedido.

How Microsoft Handles Login Security

Microsoft Entra ID (formerly called Azure Active Directory) is the security ecosystem that handles Identity and Access Management (IAM). It's responsible for tracking and authenticating sign-ins to tenant resources, as well as managing most permissions and group-management-related activities.

In practice, this is accomplished either by default, or with custom configurations.

When Entra ID is first applied to a tenant, it comes pre-enabled with a set of Security Defaults, which cover some baseline controls—e.g. restricting access to administrator resources and turning off insecure authentication methods.

Full Entra Security Defaults Baseline Protection Details.

What's relevant here is the MFA requirement, where all users must set up their Microsoft Authenticator app before their first sign in.

Security Defaults are a reasonable starting point, but it's all-or-nothing: you can't fine-tune when someone can register a method, let alone who is even allowed to in the first place. There is no extra step to confirm the person registering is the real employee, so whoever signs in first with the password gets to claim the account's MFA.

For more in depth protection, e.g. securing when and how an MFA method is registered, you'll need to shut off the Security Defaults and shell out for a paid plan.

A paid Entra Plan unlocks Conditional Access Policies (CAPs)—customizable "If-Then" statements that control login behavior. Configuring CAPs allows for more granular control over how your tenant manages access, but will completely disable the Security Defaults.

Here's an example:

Table showing Microsoft’s example Conditional Access Policy rules: Finance users accessing Payroll need MFA and a managed device, non-Finance users are blocked, and high-risk users must use MFA and reset their password.

Identity and Access Management: IAM describes the set of processes and controls that govern how a system attributes known information to a user (identity), and admits that user to the resources which they’re allowed (access). It makes sure each person has the right access to the right information and tools.

Close

El CISO ya está actuando como un CEO

Durante mi tiempo como CISO de una importante bolsa de valores, el rol se parecía menos a “seguridad” y más a liderazgo ejecutivo.

Yo era responsable de:

A este punto, la pregunta no es si el CISO actúa como un CEO, sino por qué no se le trata como uno.

In this case, IT has turned off Security Defaults, enabled Conditional Access Policies, but neglected to force MFA registration. At this point, there is nothing stopping the attacker from just logging in if they have the correct credentials. Because Conditional Access only does what you tell it to, "no rule" means "no protection."
That leaves two problems:

‍1.) The password is the only lock. If the attacker has the right credentials, they sign in with no MFA prompt at all. Once inside, they can open the account's security settings and register their own MFA method (the bootstrapping step). That locks in their access and can make it harder for the real employee to regain control.
‍
2.) Even without stolen credentials, accounts are exopsed. With no MFA in the way, the organization is still vulnerable to pre-covid era password attacks, such as password spraying. It only needs one employee to have picked a weak password.

Attackers are betting on the glaring irony here; organizations pay for an advanced Entra plan, hoping for better protection, and become laughably insecure in the process.

Password Spraying: Trying one password on many accounts—e.g. using NewHirePa$$-CHANGEM3—on accounts that might belong to new users.

Close

La ciberseguridad afecta a todos los departamentos

La ciberseguridad no es una función de TI. Es una función empresarial.

Como CISO, estás involucrado en:

Tienes visibilidad de todo, y precisamente por eso los CISOs necesitan autoridad, no solo responsabilidad.

La compensación debe estar a la altura del riesgo

No se puede pedir a alguien que asuma riesgos que podrían poner en peligro la existencia de una empresa y pagarle como si ocupara un puesto de gerencia intermedia.

Los CEOs, CFOs y COOs reciben una compensación acorde con su responsabilidad sobre el desempeño financiero, la eficiencia operativa y el crecimiento. Los CISOs, sin embargo, son responsables de prevenir incidentes que pueden paralizar las operaciones, destruir la confianza en la marca, provocar acciones regulatorias y perjudicar permanentemente el valor de la empresa.

A pesar de esto, el liderazgo de ciberseguridad suele recibir una compensación como si fuera una función de apoyo.

Si las organizaciones esperan que los CISOs protejan la empresa, deben compensarlos de manera acorde con esa responsabilidad.

La compensación debe incluir

Si una brecha de seguridad puede eliminar miles de millones en valor, la compensación debe reflejar esa realidad.

Some of you are reading this article and wondering if your Entra environment is configured correctly, whether you have Conditional Access Policies enabled, or even how you'll make sure the slew of other fifteen-minute-fixes won't fall through the cracks. These are exactly the conversations we like to have.

I hope you've enjoyed reading the first installment of The Worst Bytes. My goal here was to create something that can bring value to both the underpaid CISO and the extinguisher-wielding IT tech—hopefully I've achieved that in some capacity.

I also encourage you to check out the other posts Tenfold Security has to offer. Aaron Weissenfluh's posts offer invaluable insight for small businesses and executives alike.

El problema del éxito invisible

Darknet Diaries – Ep. 112 Dirty Coms, Ep. 118 Hot Swaps, and Ep. 154 Hijacked Line on SIM swapping and account takeovers.
IBM: Cost of a Data Breach Report 2026
Microsoft Learn: Entra Security Defaults – full baseline protection details
Microsoft Blog: Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft: Entra ID Plans and Pricing
Common Entra ID Security Assessment Findings – Part 4: Weak Conditional Access Policies
Jonathan Edwards – Stop MFA Hijacks: The One Conditional Access Policy You're Missing
Huntress: Inside Kali365 – a look at the Phishing-as-a-Service tools attackers use for token theft
Microsoft Learn: Conditional Access deployment planning – for IT teams ready to implement
The CEO of Cybersecurity – Aaron's article comparing CISO risk vs. compensation

¿La parte más difícil de ser CISO?

Demostrar que estás haciendo un buen trabajo cuando no sucede nada malo.

El éxito en ciberseguridad es silencioso. No hay celebraciones por los ataques que nunca ocurrieron, ni titulares sobre las brechas que fueron prevenidas, ni paneles que puedan reflejar por completo el caos que no sucedió. Cuando todo funciona correctamente, el trabajo en sí se vuelve invisible.

Una vez me dijeron:

“Hemos tenido una suerte extraordinaria de no haber sufrido una brecha de seguridad en más de una década.”

Esa mentalidad es más común de lo que muchos líderes creen. La prevención suele confundirse con suerte, y la preparación se subestima hasta que una falla obliga a prestarle atención. La paradoja es brutal: cuanto mejor hace su trabajo un CISO, más difícil resulta demostrar todo lo que está haciendo.

Si anuncias tu éxito, te conviertes en un objetivo. Tanto para los atacantes como para la Ley de Murphy. Pero si permaneces en silencio, el liderazgo cuestiona tu valor.

Es una situación en la que nadie gana, a menos que las organizaciones redefinen cómo se mide el éxito en ciberseguridad.

¿Quieres Saber Más?

Consulte nuestro blog sobre por qué las pruebas de penetración tradicionales no detectan las amenazas cibernéticas modernas o suscríbase para recibir actualizaciones de nuestra próxima Guía definitiva de ciberseguridad para PYMEs.