You are right, and the company is definitely to blame. But, compared to how usually other breach happens, I don't think this company was that much negligient - I mean, their only mistake was as far as I know that they did not force the users to use MFA. A mistake, sure, but not as grave as we usually see in data breaches.
My point was mostly that IMO we should in this case focus more on the users, because they are also at fault, but more importantly I think it's a pretty impactful story - "few thousand people reuse passwords, so they caused millions of users data to be leaked" is a headline that teaches a lesson in security awarness, and I think would be better to focus on that, instead of on "A company didn't force users to use MFA", which is only framed as "company has been breached and blames users". That will not teach anyone anything, unfortunately.
I'm not saying that the company shouldn't also be blamed, because they did purposefully choose to prefer user experience and conversion rate (because bad UX hurts sales, as you've mentioned) instead of better security practices, I'm just trying to figure out how to get at least something good out of this incident - and "company blames users for them getting breached" isn't going to teach anyone anything.
However, something good did come up out of it, at least for me - I've realized that it never occured to us to put "MFA is not enforced" into pentest findings, and this would make for a great case why to start doing it, so I've added it into our templates.
I agree with everything you've said. One thing that would go a long way to securing accounts would be legislation requiring all government services, banks, and credit unions to implement authenticator-based 2FA. At a minimum.
Those institutions are already very heavily regulated (at least here in Canada), so one more regulation would be meaningless.
With that in place, it would be trivial for everyone else to follow suit, since they'd know that approximately everyone has a second factor and knows how to use it.
Good for you in adding to your testing template. Security is a journey, not a destination, so keeping things up to date is important.
You are right, and the company is definitely to blame. But, compared to how usually other breach happens, I don't think this company was that much negligient - I mean, their only mistake was as far as I know that they did not force the users to use MFA. A mistake, sure, but not as grave as we usually see in data breaches.
My point was mostly that IMO we should in this case focus more on the users, because they are also at fault, but more importantly I think it's a pretty impactful story - "few thousand people reuse passwords, so they caused millions of users data to be leaked" is a headline that teaches a lesson in security awarness, and I think would be better to focus on that, instead of on "A company didn't force users to use MFA", which is only framed as "company has been breached and blames users". That will not teach anyone anything, unfortunately.
I'm not saying that the company shouldn't also be blamed, because they did purposefully choose to prefer user experience and conversion rate (because bad UX hurts sales, as you've mentioned) instead of better security practices, I'm just trying to figure out how to get at least something good out of this incident - and "company blames users for them getting breached" isn't going to teach anyone anything.
However, something good did come up out of it, at least for me - I've realized that it never occured to us to put "MFA is not enforced" into pentest findings, and this would make for a great case why to start doing it, so I've added it into our templates.
I agree with everything you've said. One thing that would go a long way to securing accounts would be legislation requiring all government services, banks, and credit unions to implement authenticator-based 2FA. At a minimum.
Those institutions are already very heavily regulated (at least here in Canada), so one more regulation would be meaningless.
With that in place, it would be trivial for everyone else to follow suit, since they'd know that approximately everyone has a second factor and knows how to use it.
Good for you in adding to your testing template. Security is a journey, not a destination, so keeping things up to date is important.